Security Enhanced Linux Reference Policy

# Layer: services

## Module: docker

Tunables Interfaces Templates

### Description:

Policy for docker

### Tunables:

dockerd_connect_user_services

##### Default value

false

##### Description

Determine whether the Docker daemon can connect to user session services such as PulseAudio and Wayland over UNIX stream sockets.

dockerd_mounton_xdg_downloads

##### Default value

false

##### Description

Determine whether the Docker daemon can mount filesystems on user XDG Downloads directories.

Return

### Interfaces:

docker_admin( domain , role )

##### Summary

All of the rules required to administrate a docker environment.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.
role | Role allowed access.

docker_domtrans_cli( domain )

##### Summary

Execute docker CLI in the docker CLI domain.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.

docker_domtrans_user_cli( domain )

##### Summary

Execute docker CLI in the docker CLI user domain.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.

docker_domtrans_user_daemon( domain )

##### Summary

Execute docker in the docker user domain.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.

docker_run_cli( domain , role )

##### Summary

Execute docker CLI in the docker CLI domain, and allow the specified role the docker CLI domain.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.
role | The role to be allowed the docker domain.

docker_run_user_cli( domain , role )

##### Summary

Execute docker CLI in the docker CLI user domain, and allow the specified role the docker CLI user domain.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.
role | The role to be allowed the docker user domain.

docker_run_user_daemon( domain , role )

##### Summary

Execute docker in the docker user domain, and allow the specified role the docker user domain.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.
role | The role to be allowed the docker domain.

docker_signal_user_daemon( domain )

##### Summary

Send signals to the rootless docker daemon.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.

Return

### Templates:

docker_user_role( role_prefix , user_domain , user_exec_domain , role )

##### Summary

Role access for rootless docker.

##### Parameters

Parameter: | Description:
--- | ---
role_prefix | The prefix of the user role (e.g., user is the prefix for user_r).
user_domain | User domain for the role.
user_exec_domain | User exec domain for execute and transition access.
role | Role allowed access.

Return