SELinux, rootless, --pid=host: only works with vfs

[edsantiago]

I'm trying to write a system test for #7902, but:

$ ./bin/podman run --pid=host alpine cat /proc/self/attr/current
unconfined_u:system_r:container_runtime_t:s0%
(expected: spc_t)

Root cause: the integration test only works because it runs on vfs. This works:

$ /bin/rm -rf /var/tmp/podman-test
$ ./bin/podman --root /var/tmp/podman-test/root --runroot /var/tmp/podman-test/runroot --storage-driver vfs run --pid=host alpine cat /proc/self/attr/current
[pull messages snipped]
unconfined_u:system_r:spc_t:s0%

This may be intentional, or at least not something that can be fixed. If so, I believe the --pid=host test in run_selinux_test.go should be clearly commented to explain this; and I think we should make a pass through all the SELinux tests to see which others are affected.

But I'm just hoping this is a bug, and we can get consistent behavior between vfs and fuse-overlay.

Originally posted by @edsantiago in #7902 (comment)

[rhatdan]

chcon -t container_runtime_exec_t ./bin/podman
Should fix the tests.

[edsantiago]

It already is; sorry for not mentioning that. I should've also mentioned that I installed podman-2:2.2.0-0.21.dev.gitcaace52.fc34 on a rawhide VM and get the same behavior. (caace52 includes #7902)

[rhatdan]

Fixed in container-selinux-2.146.0