Change container_image_t to container_file_t

[rhatdan]

Also add container_ro_file_t, for a type that can be shared into a container
as r/o/x permissions, but no write.

[rhatdan]

This fixes #165

[rhatdan]

Also we need container_ro_t to be exposed inside of /etc/selinux/targeted/contexts/lxc_contexts

cat /etc/selinux/targeted/contexts/lxc_contexts 
process = "system_u:system_r:svirt_lxc_net_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:svirt_sandbox_file_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_lxc_process = "system_u:system_r:svirt_lxc_net_t:s0"

This needs to become

process = "system_u:system_r:svirt_lxc_net_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:svirt_sandbox_file_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_lxc_process = "system_u:system_r:svirt_lxc_net_t:s0"

Needs to become:

process = "system_u:system_r:container_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:container_file_t:s0"
ro_file="system_u:object_r:container_ro_file_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_lxc_process = "system_u:system_r:container_t:s0"

[pmorie]

I really like the new names, for the record.

[rhatdan]

Yes, me too, since everytime I explain how this works I use those names and then show people the existing names, and they go BLAH...

[rhatdan]

@wrabcak PTAL

[wrabcak]

okay, merged and also updated /etc/selinux/targeted/contexts/lxc_contexts