Setup: docker-1.13 configured to use device mapper. Problem does not happen on overlay2 configurations.

Symptom:

  # docker run --rm --security-opt label:disable rhel7 cat /proc/self/attr/current
  system_u:system_r:container_runtime_t:s0
                    ^^^^^^^^^^^^^^^^^^^ -- expected spc_t

  # docker run --rm --privileged --userns=host rhel7 cat /proc/self/attr/current
  system_u:system_r:container_runtime_t:s0
                    ^^^^^^^^^^^^^^^^^^^ -- ditto


Seeing this on RHEL 7.4 and 7.5 with:

  container-selinux-2.55-1.el7.noarch
  docker-1.13.1-58.git87f2fab.el7.x86_64
  docker-1.13.1-61.git87f2fab.el7.x86_64

This is a regression since container-selinux-2.41-1.git126c1c0.el7 and docker-1.13.1-53.git774336d.el7