SELinux prevents the execution of a binary under /home that is bind mounted within a container.

Steps to reproduce :

$ pwd
/home/rgrunberg/workspace/hello

$ ls -lZ hello
-rwxrwxr-x. 1 rgrunberg rgrunberg unconfined_u:object_r:user_home_t:s0 8504 Aug 25 11:16 hello

$ docker run -v $(pwd):/tmp/hello fedora:22 /tmp/hello/hello
/tmp/hello/hello: error while loading shared libraries: cannot apply additional memory protection after relocation: Permission denied

Moving the file into /tmp on the host or just changing the file context to something like docker_exec_t seems to fix things so I'm wondering if it's possible to permit execution of user_home_t files within a container.

SELinux is preventing hello from read access on the file /tmp/hello/hello.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that hello should be allowed read access on the hello file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep hello /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:svirt_lxc_net_t:s0:c463,c931
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                /tmp/hello/hello [ file ]
Source                        hello
Source Path                   hello
Port                          <Unknown>
Host                          tornero
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.10.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     tornero
Platform                      Linux tornero 4.1.5-200.fc22.x86_64 #1 SMP Mon Aug
                              10 23:38:23 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-08-25 11:08:16 EDT
Last Seen                     2015-08-25 11:08:16 EDT
Local ID                      b72fe89e-238d-457d-abd7-0558c07d8ec5

Raw Audit Messages
type=AVC msg=audit(1440515296.252:858): avc:  denied  { read } for  pid=2385 comm="hello" path="/tmp/hello/hello" dev="sda3" ino=685602 scontext=system_u:system_r:svirt_lxc_net_t:s0:c463,c931 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0


Hash: hello,svirt_lxc_net_t,user_home_t,file,read