Hi Chintan, I got the envoy container running, but used the example config on envoy's Getting Started page: https://www.envoyproxy.io/docs/envoy/latest/start/start Steps I followed: 1) Created a starter container 2) Created an selinux policy using udica 3) Started the container and monitored /var/log/audit/audit.log for denials 4) Updated the udica generated *.cil file everytime the container failed to start, until it finally started. This took 3 attempts, starting on the 4th. Granted, not the most user friendly way of getting the container running, but I think contained from a security standpoint. 1) Starter Container ``` podman create --name envoy \ --label envoy=envoy \ -p 10000:10000 \ -v ${PWD}/envoy_example.yaml:/etc/envoy/envoy.yaml \ envoyproxy/envoy:v1.15.0 ``` 2) Create Policy & remove starter container ``` podman inspect envoy > envoy_container.json udica -j envoy_container.json envoy semodule -i envoy.cil /usr/share/udica/templates/{base_container.cil,net_container.cil} podman rm envoy ``` 3) Create Final Container, attempt to start and monitor audit.log ``` podman create --name envoy \ --security-opt label=type:envoy.process \ --label envoy=envoy \ -p 10000:10000 \ -v ${PWD}/envoy_example.yaml:/etc/envoy/envoy.yaml:Z \ envoyproxy/envoy:v1.15.0 podman start envoy ``` Each time the container failed to start it would log a denial. After each denial I updated the *.cil policy file to allow the denial, and re-applied the policy with: `semodule -i envoy.cil /usr/share/udica/templates/{base_container.cil,net_container.cil}` - Startup 1 ``` type=AVC msg=audit(1599771689.994:11166): avc: denied { read } for \ pid=1194200 comm="docker-entrypoi" path="/lib/x86_64-linux-gnu/libc-2.27.so" \ dev="dm-9" ino=71349652 scontext=system_u:system_r:envoy.process:s0:c76,c889 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0 ``` - Results in allow rule ``` (allow process default_t ( file ( read ))) ``` - Startup 2 ``` type=AVC msg=audit(1599772073.397:11205): avc: denied { setattr } for \ pid=1218170 comm="chown" name="" dev="pipefs" \ ino=6650489 scontext=system_u:system_r:envoy.process:s0:c76,c889 tcontext=unconfined_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0 ``` - Results in allow rule ``` (allow process container_runtime_t ( fifo_file ( setattr ))) ``` - Startup 3 ``` type=AVC msg=audit(1599772272.855:11237): avc: denied { name_bind } for \ pid=1232662 comm="envoy" src=9901 \ scontext=system_u:system_r:envoy.process:s0:c76,c889 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 ``` - Results in allow rule ``` (allow process unreserved_port_t ( tcp_socket ( name_bind ))) ``` The final *.cil file looked like this: ``` (block envoy (blockinherit container) (blockinherit restricted_net_container) (allow process process ( capability ( audit_write chown dac_override fowner fsetid kill mknod net_bind_service net_raw setfcap setgid setpcap setuid sys_chroot ))) (allow process usr_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) (allow process usr_t ( file ( getattr read write append ioctl lock map open create ))) (allow process usr_t ( sock_file ( getattr read write append open ))) (allow process default_t ( file ( read ))) (allow process container_runtime_t ( fifo_file ( setattr ))) (allow process unreserved_port_t ( tcp_socket ( name_bind ))) ) ``` Container started and a curl test was successful ``` # podman ps -a --filter "label=envoy=envoy" CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 44f02a9f2ac3 docker.io/envoyproxy/envoy:v1.15.0 envoy -c /etc/env... About a minute ago Up About a minute ago 0.0.0.0:10000->10000/tcp envoy # curl -I localhost:10000 HTTP/1.1 200 OK content-type: text/html; charset=ISO-8859-1 p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." date: Thu, 10 Sep 2020 21:40:16 GMT server: envoy x-xss-protection: 0 x-frame-options: SAMEORIGIN expires: Thu, 10 Sep 2020 21:40:16 GMT cache-control: private set-cookie: 1P_JAR=2020-09-10-21; expires=Sat, 10-Oct-2020 21:40:16 GMT; path=/; domain=.google.com; Secure set-cookie: NID=204=Py9ONzAvLYe41BNU_HWe88th45fOsxWWmjbh6aodR2wroK8r7gY8blxHV54zG7deSKNmtOT66FQQnyPn8vpk_vb6CwE6ZH-_D3KQgNByttyF2qdUifuYnfzMlirQKv1aWejLrQPdTpt7WDjULDZDTlNpa9BIsvfA4dSShDrfgx4; expires=Fri, 12-Mar-2021 21:40:16 GMT; path=/; domain=.google.com; HttpOnly alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-envoy-upstream-service-time: 64 transfer-encoding: chunked ``` Hope this helps.