What's the best practice to upgarde selinux?

[haoqing0110]

What's the best practice to upgarde selinux?

[rhatdan]

It is ok to restoreon on it. Although most likely not neessary. Usually the AVC will mention a file name (Sadly not a path). If you know where this file is, you could try a restorecon on it. But I would doubt that is the issue.
Usually one you fix fix the labeling on /var/lib/docker or /var/lib/containers for podman you are good to go.

Most people experience SELinux issues when volume mounting in content into a container. And the :z and :Z options help out in that case.

I wrote these articles to explain SELinux and containers

https://opensource.com/article/18/2/understanding-selinux-labels-container-runtimes
https://www.projectatomic.io/docs/docker-and-selinux/

[rhatdan]

@haoqing0110 It should never be needed again. It is supposed to be done the first time it installs. Somehow this got mislabeled.
BTW Have you tried podman?

[haoqing0110]

@rhatdan so if I meet above issue, it that ok to restorecon to whole dir /var/lib/docker? It takes quite a few minutes to finish running.

Do you have any suggestion how to debug which file is mislabeled?