Bug 1187236

open("/etc/selinux/config", O_RDONLY)   = -1 ENOENT (No such file or directory)
futex(0x7f83e0699728, FUTEX_WAKE_PRIVATE, 2147483647) = 0
open("/host/sys/fs/selinux/status", O_RDONLY|O_CLOEXEC) = 31
mmap(NULL, 4096, PROT_READ, MAP_SHARED, 31, 0) = 0x7f83e1c9c000
open("/etc/selinux/targeted/contexts/files/file_contexts.subs_dist", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/selinux/targeted/contexts/files/file_contexts.subs", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/selinux/targeted/contexts/files/file_contexts", O_RDONLY) = -1 ENOENT (No such file or directory)
fstat(19, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83e1c9b000
write(19, "warning: Failed to open SELinux "..., 40) = 40

Does the container think SELinux is enabled?

id -Z

How does yum even know about the $HOST?

Using -v /:/host
-bash-4.2# docker run -t -i --rm -v /:/host -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-t-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
system_u:system_r:docker_t:s0

After removing -v /:/host
-bash-4.2# docker run -t -i --rm -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
id: --context (-Z) works only on an SELinux-enabled kernel

setsebool -P docker_transition_unconfined 1

Which I think we need to turn on by default.

I have no idea why / mounted at /host would tell libselinux to activate.

The only way I would see thi would be if /sys:/sys was mounted.

Dan it's your call, but perhaps we can table this for now, as yum works in the rhel-tools container despite the warning.  I set the prio to medium.

-bash-4.2# setsebool -P docker_transition_unconfined 1

-bash-4.2# getsebool docker_transition_unconfined
docker_transition_unconfined --> on

-bash-4.2# docker run -t -i --rm -v /:/host -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
system_u:system_r:unconfined_t:s0

-bash-4.2# docker run -t -i --rm -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
id: --context (-Z) works only on an SELinux-enabled kernel

What should actually be done to fix this in an image?

We are working to fix this in policy.  Not an image.  We want all privileged containers to run as spc_t and then allow domains to communicate with them.  We used to run as unconfined_t but this is really a user context.  

spc_t will be an unconfined domain, which other domains can communicate with since we will probably have confined domains and containers that need to talk to a SPC container.

We have changed atomic --spc to mount /sys/fs/selinux as readonly to tell SELinux not to do labels stuff.