container_ro_file_t ?

[containers]

container_ro_file_t ?

[rhatdan]

Yes, the type is actually container_share_t.

[rhatdan]

@wrabcak Could you make the change.

[wrabcak]

@rhatdan, is it big issue to keep it there? Did podman/docker use this reference in past?

Thanks,
Lukas.

[rhatdan]

No I know of nothing that uses this. and I guess it is ok, since it is defined and their is a relationship between container domains and this file type.

[rhatdan]

sesearch -A -s container_t -t container_ro_file_t -c file -p read

allow svirt_sandbox_domain container_ro_file_t:file { execmod execute execute_no_trans getattr ioctl lock map open read };

@AkihiroSuda Looks like we have it in policy. The issue is no tools read
ro_file="system_u:object_r:container_ro_file_t:s0"
that I know of. (I added that many years ago (2012?) when we were working on virt-sandbox, prior to Docker)