[PATCH 0/1] selinux: Transition to pasta_t in containers

[Max Chernoff <git@maxchernoff.ca>]

Hi,

Currently, pasta runs in the container_runtime_exec_t context when
running in a container. This commit updates the SELinux policy so that
pasta instead runs in the pasta_t context.

I'm more familiar with CIL, so I initially developed the modified policy
in CIL, and then later ported it to the kernel policy language. My
original CIL source is available here:

    https://github.com/gucci-on-fleek/maxchernoff.ca/blob/master/etc/selinux/local-policies/local-pasta.cil

I've tested this on Fedora 42 with rootless Podman, with both unconfined
(unconfined_u) and confined (user_u) users, and with both TCP and UDP.

I've never actually used the email workflow for Git before, so please
let me know if I've done something wrong.

Thanks,
-- Max

Max Chernoff (1):
  selinux: Transition to pasta_t in containers

 contrib/selinux/pasta.fc | 10 ++++++----
 contrib/selinux/pasta.te | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

--
2.49.0