Tools that use containers-storage (Buildah) run as the unconfined user rather then running as container_runtime_t. When unconfined user creates content in /var/lib/containers/storage it does not transition to the correct label.
Fixed in containers-selinux-2.32
Best way to test this is to
rm -rf /var/lib/containers/storage
# setenforce 1
# ctr=$(buildah from fedora)
# buildah run $ctr echo hello
If this works, then the bug is fixed.
You could also run
restorecon -R -v /var/lib/containers/storage
And you should see no mislabeled files.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.