3 ms·
It sounds like podman containers should automatically get that label so I'll give it another look, thanks!
by bongobingo1 4y ago
It sounds like podman containers should automatically get that label so I'll give it another look, thanks!
- yrro 4y agoYeah, use ps -Z PID (from outside of a container) to check its label. Some other useful sources of info - the container_selinux man page tells you about container_t. And an index of Dan Walsh's blog posts about containers & SELinux can be found in the README of <https://github.com/containers/container-selinux https://github.com/containers/container-selinux>. And of course the RHEL documentation for creatign custom SELinux policies that inherit from container_t (for instance, I use it to allow processes within a container to read their certificates out of /etc/pki/tls which is normally forbidden. It's documented here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/creating-selinux-policies-for-containers_using-selinux#doc-wrapper https://access.redhat.com/documentation/en-us/red_hat_enterp...