Issues on Fedora (container-selinux-2.211.1) with container_domain_template

[damaestro]

Issues on Fedora (container-selinux-2.211.1) with container_domain_template

[rhatdan]

Is this still an issue with current policy in main?

[damaestro]

@rhatdan I just tried again with container-selinux-2:2.221.0-1.fc38.noarch and it fails in the same way.

[rhatdan]

diff --git a/src/nvidia-container-selinux/nvidia-container.te b/src/nvidia-container-selinux/nvidia-container.te
index 3fb80a3..e963ff5 100644
--- a/src/nvidia-container-selinux/nvidia-container.te
+++ b/src/nvidia-container-selinux/nvidia-container.te
@@ -13,9 +13,10 @@ gen_require(`
        attribute kernel_system_state_reader;
        attribute container_net_domain;
        attribute syslog_client_type;
+       type container_file_t;
 ')
 
-container_domain_template(nvidia_container)
+container_domain_template(nvidia_container, container)
 
 typeattribute nvidia_container_t sandbox_net_domain;
 typeattribute nvidia_container_t sandbox_caps_domain;

[rhatdan]

I went to try to add this to nvidia, but they do not allow pull requests.

[damaestro]

@rhatdan thanks, with this patch the policy builds and works. I'll just add a downstream patch for now and opened a PR.