contrib/selinux: Add CIL policy to deny AF_VSOCK sockets

Moby's default seccomp profile denies direct AF_VSOCK socket creation
so ordinary containers cannot connect to virtual machines on the host.
On architectures with the 32-bit socketcall syscall, seccomp cannot
inspect the address family because it is passed through a userspace
pointer.

Add a SELinux deny rule for vsock_socket creation. SELinux enforces
this at the socket creation hook, so it covers both socket and
socketcall.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

contrib/selinux/docker-af-vsock-deny.cil

@@ -0,0 +1,12 @@
+;; Block AF_VSOCK sockets in container domains.
+;; AF_VSOCK could let a container connect to virtual machines running on the
+;; host.
+;;
+;; This rule targets container_domain (container_t, spc_t, etc.) and
+;; does not affect the container runtime (container_runtime_t) or host
+;; processes.
+;;
+;; Requires SELinux userspace >= 3.6 for CIL deny support.
+;; Requires container-selinux for the container_domain attribute.
+
+(deny container_domain self (vsock_socket (create)))