container_ro_file_t ?

[AkihiroSuda]

# cat /etc/selinux/targeted/contexts/lxc_contexts 
process = "system_u:system_r:container_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:container_file_t:s0"
ro_file="system_u:object_r:container_ro_file_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_lxc_process = "system_u:system_r:container_t:s0"

RHEL 8.0 lxc_contexts contains reference to system_u:object_r:container_ro_file_t:s0, but the type doesn't seem defined in this repo and yet doesn't seem used by Podman and Docker.

Maybe the type should be removed from lxc_contexts?

[rhatdan]

Yes, the type is actually container_share_t.

[rhatdan]

@wrabcak Could you make the change.

[wrabcak]

@rhatdan, is it big issue to keep it there? Did podman/docker use this reference in past?

Thanks,
Lukas.

[rhatdan]

No I know of nothing that uses this. and I guess it is ok, since it is defined and their is a relationship between container domains and this file type.

[rhatdan]

sesearch -A -s container_t -t container_ro_file_t -c file -p read

allow svirt_sandbox_domain container_ro_file_t:file { execmod execute execute_no_trans getattr ioctl lock map open read };

@AkihiroSuda Looks like we have it in policy. The issue is no tools read
ro_file="system_u:object_r:container_ro_file_t:s0"
that I know of. (I added that many years ago (2012?) when we were working on virt-sandbox, prior to Docker)