What AVCs are they seeing? I have added https://github.com/containers/common/pull/1448 https://github.com/containers/podman/pull/18439 TO allow better integration with RBAC, which could help fix this problem.
Who is the customer and could I get access to them to try out changes.
type=AVC msg=audit(1684333365.285:1313): avc: denied { create } for pid=10674 comm="fuse-overlayfs" name=".wh..opq" scontext=staff_u:staff_r:container_runtime_t:s0-s15:c0.c1023 tcontext=staff_u:object_r:data_home_t:s0 tclass=chr_file permissive=0 This looks like a labelng issue in the homedir. container-selinux was never written to work on MLS machines. I can add some additional rules, but I have no MLS machine to work on and do not intend to work on one. If the customer wants to open PRs to add support for MLS then that is good with me. I opened a PR to fix some of the issues mentioned above https://github.com/containers/container-selinux/pull/246
Setting to Post and assigning to @jnovy for any further packaging or BZ needs.
I would almost guarantee that it will not. the Customer needs to work with me in the upstream to get this to work,
@cpippin Thanks for the update. We'd be happy to work with the customer in any way that they feel comfortable and that they have the time for. If they would like to contribute directly to the upstream, that would be wonderful. If they're open to discussing this with Dan at some point, either in a meeting or via email or this BZ, that would be extremely helpful. If they have the time and resources, if they could test whatever Dan comes up with, that too would be extremely helpful. So, in short, we're open to however involved the customer would like to get involved and is able to get involved. I've also changed this BZ to and RFE. I hope that helps!
Yes the idea would be to go through the upstream, and not have to go through Red Hat support. That way we could innovate quicker.
Yes I will mark this as notabug, and continue working with customer in upstream.