man(8)

💖 NAME 💖

okay bestie, meet udica — it's a tool for generating SELinux security profiles for containers. yes, that's the whole vibe. it's giving "container security but make it cute." 🫶

this little legend lives in section 8 of the manual (the man(8) one, admin/system tools territory, iykyk), and the page you're reading right now is the udica man page. slay.

---

✨ SYNOPSIS ✨

udica [options] container_name

---

🌸 DESCRIPTION 🌸

So here's the tea, bestie. udica is a tool for generating SELinux security profiles for containers. The whole concept is based on the "block inheritance" feature inside the CIL intermediate language supported by the SELinux user space. 🤯

The tool creates a policy which combines rules inherited from specified CIL blocks (templates) and rules discovered by inspection of the container JSON file with mount points and port definitions.

literally that's it. templates + JSON inspection = policy. no cap. 💅

---

🐳 SUPPORTED CONTAINER ENGINES 🐳

• CRI-O v1.14.10+
• docker v1.13+
• podman v2.0+

(and yes there's a comma at the end of that list in the original, iconic behavior, we stan)

---

💅 OPTIONS 💅

• -h, --help — Show this help message and exit. the classic "help me please" button 🎀
• -i, --container-id ID — An ID of the running container for which should be an SELinux policy created. so like, the container that's running right now that you want a policy for.
• -j, --json JSONFILE — Load JSON content of the inspected container from this file. file-based inspo instead of live inspo ✨
• -l, --load-modules — Load templates and module created by this tool. go ahead, load 'em up.
• -c, --caps CAPS — List of capabilities, for example: -c AUDIT_WRITE,CHOWN,DAC_OVERRIDE,FOWNER,FSETID,KILL. mandatory to use for Docker Engine, see the BUGS section — like, actually required, not a suggestion, fr fr.
• --devices DEVS — List of devices the container should have access to, e.g --devices /dev/dri/card0,/dev/dri/renderD128. this one overrides devices specified in the conatiner JSON (yes, "conatiner," that's how it's spelled in the original and I will not be fixing it, it's canon now 🙈).
• -a, --append-rules FILE — Append more SELinux allow rules generated from SELinux denials in audit daemon. the audit denials said no but you say yes 💅
• -s, --stream-connect DOMAIN — Allow container to stream connect with given SELinux domain.
• -e, --container-engine ENGINE — Specify which container engine is used for the inspected container (supports: CRI-O, docker, podman).
• --full-network-access — Allow a container full network access. the whole internet, bestie. 🌈
• --tty-access — Allow a container to read and write the controlling terminal. terminal access, unlocked 🔓
• --X-access — Allow a container to communicate with the X server. (note the capital X, it's fancy like that 👑)
• --virt-access — Allow a container to communicate with libvirt. virtualization besties unite 🧚

---

🔥 EXIT STATUS 🔥

• 0 — no errors encountered. we ate and left no crumbs ✨
• 1 — other errors.
• 2 — error while parsing options. oops, syntax moment 😭
• 3 — error while getting container info. couldn't find the container, tragic 💀
• 4 — error while creating an SELinux policy. the policy said "not today."

---

🎀 EXAMPLES 🎀

# cat my_con.json | udica --x-access --full-network-access my_container

Creates a new SELinux policy with name my_container based on inspecting container and adding access to the X server and full network access.

(and yes the example uses --x-access lowercase while the option list says --X-access — I'm reporting it exactly as written, don't come for me 🫶)

---

🦋 SEE ALSO 🦋

selinux(8), podman(1)

---

💀 BUGS 💀

okay so listen, there are some things you simply must know:

• Since it is not possible to detect capabilities used by a container in Docker Engine, you have to use -c to specify capabilities for docker container manually. do not skip this one, bestie.
• It is not possible to generate a custom local policy using the "audit2allow -M" command from AVCs where source context was generated by udica. For this purpose please use --append-rules option.
• In some situations udica fails to identify which container engine is used, therefore "--container-engine" parameter has to be used to inform udica how JSON inspection file should be parsed.

---

🙈 REPORTING BUGS 🙈

Report bugs to <https://github.com/containers/udica/issues/>

---

👑 AUTHOR 👑

Written by Lukas Vrabec (lvrabec@redhat.com)

---

and that's the whole page, bestie!! 💖✨ source/version 1.1, dated 17 February 2019, from the man(8) manual. she's been iconic since 2019 and she's still serving. periodt. 🎀🦋💅