Additional rules for container_user_t

[rhatdan]

Fixes: most of #293

[rhatdan]

@bachradsusi PTAL

[bachradsusi]

----
time->Fri Jan 19 06:13:47 2024
type=AVC msg=audit(1705662827.232:594): avc:  denied  { read write } for  pid=2114 comm="sh" path="/dev/pts/0" dev="devpts" ino=3 scontext=container_user_u:container_user_r:container_user_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:container_devpts_t:s0 tclass=chr_file permissive=1
----
time->Fri Jan 19 06:13:47 2024
type=AVC msg=audit(1705662827.233:595): avc:  denied  { ioctl } for  pid=2114 comm="sh" path="/dev/pts/0" dev="devpts" ino=3 ioctlcmd=0x5401 scontext=container_user_u:container_user_r:container_user_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:container_devpts_t:s0 tclass=chr_file permissive=1

[bachradsusi]

It works with this change:

diff --git a/container.te b/container.te
index 51c55a5..109f81c 100644
--- a/container.te
+++ b/container.te
@@ -703,6 +703,7 @@ optional_policy(`
        gen_require(`
                role unconfined_r;
        ')
+       allow unconfined_r container_user_r;
        role unconfined_r types container_user_domain;
        role unconfined_r types spc_t;
        unconfined_domain(container_runtime_t)
@@ -1560,3 +1561,5 @@ tunable_policy(`deny_ptrace',`',`
        allow container_domain self:process ptrace;
        allow spc_t self:process ptrace;
 ')
+
+allow container_user_t container_devpts_t:chr_file { ioctl read write };

[bachradsusi]

👍🏻