[rhaos-maint] selinux: fix containers access for shared runtime directories

[openshift-cherrypick-robot]

This is an automated cherry-pick of #397

/assign lsm5

Summary by Sourcery

Bug Fixes:

• Allow containers to access shared runtime directories under SELinux policy

[gemini-code-assist]

Summary of Changes

Hello @openshift-cherrypick-robot, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an SELinux policy issue by refining the permissions granted to containers for accessing shared runtime directories. The change ensures that containers have the necessary access for OCI runtime optimizations, resolving potential permission-related problems. This is a cherry-pick of an upstream fix.

Highlights

• SELinux Policy Update: Modified the container.te SELinux policy file to adjust permissions for containers accessing shared runtime directories.
• Permission Refinement: Replaced explicit "read" and "open" permissions on container_var_run_t:dir with the "list_dir_perms" macro, providing a more appropriate set of permissions for directory listing operations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR cherry-picks a bug fix that extends SELinux policy to allow container_t to properly access shared runtime directories by defining a new file type and updating allow rules in the container policy.

File-Level Changes

Change	Details	Files
Define new SELinux file type for shared runtime directories	Declare container_runtime_var_run_t type Assign container_runtime_var_run_t to relevant runtime paths via file context	container.te
Grant container_t domain permissions on shared runtime directories	Add allow rules for container_t to search/open/read/write container_runtime_var_run_t Include getattr to support metadata operations	container.te

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[gemini-code-assist]

Code Review

This pull request updates the SELinux policy in container.te to fix container access to shared runtime directories. The change replaces a specific set of permissions ({ read open }) with the more comprehensive and standard list_dir_perms macro. This is a good change as it correctly grants the necessary permissions for containers to list directory contents, which was not possible with the previous rule, and it improves policy maintainability by using a standard macro for a common operation. The change aligns with the stated goal of enabling OCI runtime optimizations.

[lsm5]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lsm5, openshift-cherrypick-robot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [lsm5]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment