walters reported a new issue against the project: `atomic-wg` that you are following:
SELinux and containers - a fairly nontrivial difference we carry from other distributions
(Ubuntu, CL) etc. that either don't use SELinux or aren't enforcing. See [this
for some discussion about the `:z/:Z` flags.
The fact that we require these labels to be set very, very commonly trips up people. And
further, I think a big problem with `:z` is that it forces a relabel every time - it's
much better to have the labels set up correctly in the first place!
Another related issue is that people do e.g. `-v /home/myuser:/home:z` which will
completely break the OS which expects `/home/myuser` to be `user_home_dir_t` etc.
Hence, my proposal is: For Atomic Host, change `/var/srv` to be
`system_u:object_r:container_share_t:s0` by default. It can then be *assumed* as a
default interchange point for containers and the host - no labeling required.
Positives: We can start documenting this, and other tools (like a pet container one) can
just assume this works.
Downsides: If we don't do this for classic as well, we'll have introduced a new
special distinction between AH and classic - we currently have very few of those.
To reply, visit the link below or just reply to this email