docs: clarify SELinux domain runtime guidance - #63
Closed
SeanDougherty wants to merge 9 commits into
Closed
Conversation
Remove access to auditd_log_t from container_logreader_t because audit logs contain host-wide security events outside the general log collector use case. Document specialized container domains, selection examples, MCS behavior, and audit-log exclusion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Document the actual watch and audit boundaries on ACL, replace validation commands with stock journald equivalents, and grant read-only mmap access required by journalctl for persistent systemd journals. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Retain the audit-log read semantics established by container-selinux so compatible collectors do not need spc_t, collapse the package to one release bump, and make sensitive audit mounts explicit. Keep the read-only journal mmap addition. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Expand the SELinux guide into a customer-facing reference for every workload-selectable container domain, including privilege and MCS boundaries, selection examples, internal types to avoid, and guidance for requesting narrower policy instead of using spc_t. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Correct the KVM and common-container access descriptions, document stock privileged-domain behavior, warn about type-only MCS allocation in multi-container pods, and identify Podman and unavailable container_init_t contexts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Keep text labels for accessibility while adding colored glyphs for faster table scanning, and align the audit capability row with canonical container-selinux semantics. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Clarify that Kubernetes SELinux type selection requires CRI SELinux support, note that ACL enables it in its embedded containerd configuration, and provide an effective-setting verification command. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Define system and user engine policy scope, remove the unsupported Podman launch example, clarify when auditd mounts apply, and simplify the capability table legend. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Clarify spc and KVM capability comparisons, document journal DAC requirements, make multi-container MCS guidance collision-safe, soften cross-OS runtime defaults, and anchor policy claims to the shipped release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
16 tasks
Author
SeanDougherty
added a commit
that referenced
this pull request
Aug 28, 2026
Add a customer-facing reference for ACL container workload domains, privilege boundaries, CRI and MCS requirements, journal DAC, audit behavior, and troubleshooting guidance. Includes the reviewed follow-ups previously tracked in #63.\n\nAB#23415
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow up on Jiri’s latest review of #60 without blocking the core policy and domain-reference PRs.
This PR targets
aclmaindirectly and will remain independent of the #59/#60 review chain. It is temporarily opened as a draft from the cumulative tree; after #59 and #60 merge, its branch will be rebased onto the updatedaclmainso the final diff contains only the review follow-ups below.Changes
container_init_tstatement toselinux-policy-2.20250213-10.systemd-journalGID 190 viasupplementalGroupsand document DAC-vs-SELinux diagnosis for journal reads.Validation
systemd-journalat GID 190.Azure Boards: AB#23415