2 ms·
> Maybe I just missed an obvious route to disable swaths of SELinux for rootless containers Yeah you can put container_t into permissive mode: # semanage perm
by yrro 4y ago
> Maybe I just missed an obvious route to disable swaths of SELinux for rootless containers
Yeah you can put container_t into permissive mode:
# semanage permissive -a container_t
AVC denials will still be logged but the operations won't be denied.
- bongobingo1 4y agoIt sounds like podman containers should automatically get that label so I'll give it another look, thanks!
- yrro 4y agoYeah, use ps -Z PID (from outside of a container) to check its label. Some other useful sources of info - the container_selinux man page tells you about container_t. And an index of Dan Walsh's blog posts about containers & SELinux can be found in the README of <https://github.com/containers/container-selinux https://github.com/containers/container-selinux>. And of course the RHEL documentation for creatign custom SELinux policies that inherit from container_t (for instance, I use it to allow processes within a container to read their certificates out of /etc/pki/tls which is normally forbidden. It's documented here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/creating-selinux-policies-for-containers_using-selinux#doc-wrapper https://access.redhat.com/documentation/en-us/red_hat_enterp...