Bug 2192892

Summary:	[RFE] Podman 4.2.0 does not work with the MLS policy
Product:	Red Hat Enterprise Linux 8	Reporter:	Carroline <cpippin>
Component:	container-selinux	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NOTABUG	QA Contact:	Edward Shen <weshen>
Severity:	low	Docs Contact:
Priority:	high
Version:	8.7	CC:	ajia, bbaude, bhenders, dornelas, dwalsh, jligon, jnovy, lsm5, mboddu, mheon, pthomas, tsweeney, umohnani
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-12 18:03:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Daniel Walsh 2023-05-03 13:33:30 UTC

What AVCs are they seeing?

I have added 
https://github.com/containers/common/pull/1448

https://github.com/containers/podman/pull/18439

TO allow better integration with RBAC, which could help fix this problem.

Comment 2 Daniel Walsh 2023-05-03 13:34:14 UTC

Who is the customer and could I get access to them to try out changes.

Comment 9 Daniel Walsh 2023-05-17 22:44:14 UTC

type=AVC msg=audit(1684333365.285:1313): avc:  denied  { create } for  pid=10674 comm="fuse-overlayfs" name=".wh..opq" scontext=staff_u:staff_r:container_runtime_t:s0-s15:c0.c1023 tcontext=staff_u:object_r:data_home_t:s0 tclass=chr_file permissive=0

This looks like a labelng issue in the homedir. 

container-selinux was never written to work on MLS machines.  I can add some additional rules, but I have no MLS machine to work on and do not intend to work on one.

If the customer wants to open PRs to add support for MLS then that is good with me.

I opened a PR to fix some of the issues mentioned above

https://github.com/containers/container-selinux/pull/246

Comment 10 Tom Sweeney 2023-05-18 19:22:24 UTC

Setting to Post and assigning to @jnovy  for any further packaging or BZ needs.

Comment 13 Daniel Walsh 2023-05-22 16:02:00 UTC

I would almost guarantee that it will not. the Customer needs to work with me in the upstream to get this to work,

Comment 17 Tom Sweeney 2023-05-24 23:41:07 UTC

@cpippin Thanks for the update.  We'd be happy to work with the customer in any way that they feel comfortable and that they have the time for.  If they would like to contribute directly to the upstream, that would be wonderful.  If they're open to discussing this with Dan at some point, either in a meeting or via email or this BZ, that would be extremely helpful.  If they have the time and resources, if they could test whatever Dan comes up with, that too would be extremely helpful.  So, in short, we're open to however involved the customer would like to get involved and is able to get involved.

I've also changed this BZ to and RFE.

I hope that helps!

Comment 19 Daniel Walsh 2023-05-26 18:03:12 UTC

Yes the idea would be to go through the upstream, and not have to go through Red Hat support.
That way we could innovate quicker.

Comment 22 Daniel Walsh 2023-06-12 18:02:59 UTC

Yes I will mark this as notabug, and continue working with customer in upstream.