
type karmor_global_t; # domain

type karmor_global_block_t; # blocked process

# kubearmor service -> assign karmor_global_block_t to a target
allow unconfined_service_t karmor_global_block_t:file { getattr relabelfrom relabelto };

# unconfined_t -> karmor_global_block_t
allow unconfined_t karmor_global_block_t:file { karmor_no_process_execution };
allow karmor_global_block_t fs_t:filesystem { associate };

type karmor_global_read_t;

# kubearmor service -> assign karmor_global_read_t to a target
allow unconfined_service_t karmor_global_read_t:file { getattr relabelfrom relabelto };

# unconfined_t -> karmor_global_read_t;
allow_readonly_file_access(unconfined_t, karmor_global_read_t)
allow karmor_global_read_t fs_t:filesystem { associate };

type karmor_global_none_t;

# kubearmor service -> assign karmor_global_none_t to a target
allow unconfined_service_t karmor_global_none_t:file { getattr relabelfrom relabelto };

# unconfined_t -> karmor_global_none_t;
allow_no_file_access(unconfined_t, karmor_global_none_t)
allow karmor_global_none_t fs_t:filesystem { associate };
