Lack of 'range' field in fcontext causes error in go-linux.NewContext() about selinux HOT 6 CLOSED

We probably should handle this in opencontainers/selinux, but the benefit of SELinux and Containers falls quite a bit without MCS/MLS Container Separation. We rely on the forth field to keep containers separate. Is there a targeted policy available for gentoo that supports the MCS/MLS Field?

from selinux.

Patch to allow you to use selinux on non MCS machines #25

from selinux.

@rhatdan Oh thank you for quick reply and advice.

Is there a targeted policy available for gentoo that supports the MCS/MLS Field?

Currently no, probably. I've confirmed the fourth field is present at mls settings and disappear at targeted settings. Though I can do it myself manually, I don't think it is a good idea. I'd like to communicate with Gentoo SELinux project team about this topic with the benefit of container separation with the MLS/MCS field in targeted mode.

At last thank you again for quick action to fix it!!

from selinux.

Could you apply the patches to your podman to see if it actually fixes your issue?

from selinux.

Works fine. Thanks!!

from selinux.

This issue is fixed.

from selinux.