Re: [PATCH 1/2] selinux: add container_var_run_t type transition

[Paul Holzinger <pholzing@redhat.com>]

On 17/09/2025 17:05, Stefano Brivio wrote:
> On Wed, 17 Sep 2025 14:04:50 +0200
> Paul Holzinger <pholzing@redhat.com> wrote:
>
>> In some cases the podman runroot directory used to be labelled
>> container_var_run_t instead of user_tmp_t which was expected here.
>> Starting with a recent container-selinux change the runroot is now
>> always container_var_run_t so make the policy handle both types to allow
>> for a better upgrade path where passt-selinux and container-selinux are
>> not updated at the same time.
>>
>> Link: https://github.com/containers/container-selinux/pull/405
> Even if I just proposed a revert for this one:
>
>    https://github.com/containers/container-selinux/pull/405
>
>> Link: https://github.com/containers/podman/issues/26473
> it's still good to have this other issue fixed. Even though I'm not
> sure adding more and more labels to pasta's policy is the way to go,
> Podman issue #26473 has been open for way too long, so let's be
> pragmatic here at the slight expense of keeping profiles tight.
>
> Just a couple of nits (I can fix it all up on merge if you're fine with
> it, no need to re-post):
yes please fix them, just note the one comment on the different link below
>
>> Signed-off-by: Paul Holzinger <pholzing@redhat.com>
>> ---
>>   contrib/selinux/pasta.te | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
>> index c0a1e9b..24e58c8 100644
>> --- a/contrib/selinux/pasta.te
>> +++ b/contrib/selinux/pasta.te
>> @@ -96,6 +96,7 @@ require {
>>   	role staff_r;
>>   	role user_r;
>>   	type container_runtime_t;
>> +	type container_var_run_t;
>>   	type container_t;
>>   	type systemd_user_runtimedir_t;
>>   }
>> @@ -242,8 +243,12 @@ type_transition container_runtime_t pasta_exec_t : process pasta_t;
>>   allow container_runtime_t pasta_t:process transition;
>>   
>>   # Label the user network namespace files
>> +# Note podman files used to be user_tmp_t but now are container_var_run_t since
> s/podman/Podman/
>
>> +# https://github.com/containers/container-selinux/issues/404.
> I'd drop the . at the end because some URL parsers might miss the fact
> that it's not part of the URL, and require additional intervention once
> you press enter / click on the link.

Sure, but actually that should link 
https://github.com/containers/container-selinux/pull/405 instead.

The issue doesn't really have a meaningful context for pasta.

>
>>   type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns";
>> +type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns";
>>   type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns";
>> +type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns";
>>   allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write };
>>   allow pasta_t ifconfig_var_run_t:file { create open write };
>>   allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir;

-- 
Paul Holzinger