feat: support /var/lib/crio

[maage]

With:

cri-o1.31-1.31.3-1.fc41.x86_64

It runs as:

container-selinux/container.fc

Line 48 in 7fdbd0e

/usr/s?bin/crio.* -- gen_context(system_u:object_r:container_runtime_exec_t,s0)

and:

container-selinux/container.te

Line 307 in 7fdbd0e

files_var_lib_filetrans(container_runtime_domain, container_var_lib_t, { dir file lnk_file })

means files under /var/lib/crio should be container_var_lib_t.

Summary by Sourcery

New Features:

• Support managing files under /var/lib/crio using cri-o.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request modifies the SELinux policy to allow containers to access files under /var/lib/crio with the container_var_lib_t type. This change is necessary to support CRI-O 1.31 and later versions.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Added support for /var/lib/crio to be labeled as container_var_lib_t.	Added a new line to the container.fc file to label /var/lib/crio as container_var_lib_t.	container.fc

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey @maage - I've reviewed your changes - here's some feedback:

Overall Comments:

• Please provide a more detailed description of the specific SELinux context changes being implemented, including how they were tested.

Here's what I looked at during the review

• 🟢 General issues: all looks good
• 🟢 Security: all looks good
• 🟢 Testing: all looks good
• 🟢 Complexity: all looks good
• 🟢 Documentation: all looks good

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[maage]

I tested this just by running sudo restorecon -nvR -e /var/lib/mock -e /var/cache/mock /var and analyzing output.

Then I added:

sudo semanage fcontext -a -t container_var_lib_t '/var/lib/crio(/.*)?'

Rerun the restorecon again.

This is needed to avoid relabeling files and causing disruption.

[lsm5]

LGTM

@rhatdan @haircommander PTAL

[rhatdan]

LGTM