Allow container to access ns_last_pid

[adrianreber]

Allow container to access ns_last_pid

[rhatdan]

It is already in

rpm -q container-selinux
container-selinux-2.100-1.git3b78187.fc30.noarch

sesearch -A -s container_t -t sysctl_kernel_ns_last_pid_t
allow container_domain sysctl_kernel_ns_last_pid_t:dir { getattr ioctl lock open read search };
allow container_domain sysctl_kernel_ns_last_pid_t:file { append getattr ioctl lock open read write };
allow container_domain sysctl_type:dir { getattr ioctl lock open read search };
allow container_domain sysctl_type:file { getattr ioctl lock open read };
allow svirt_sandbox_domain sysctl_type:dir { getattr ioctl lock open read search };
allow svirt_sandbox_domain sysctl_type:file { getattr ioctl lock open read };

Went i in container-selinux 2.96.

* Thu Apr 04 2019 Dan Walsh <[email protected]> - 2.96-1
- Allow containers to read/write sysctl_kernel_ns_last_pid_t

[adrianreber]

Thanks. Should have looked closer. I was finally able to enable checkpoint/restore in Podman's CI again and all tests are green: containers/podman#2705