container_selinux(8)

📦
version 2.251.0 · 2 versions
, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

💖 NAME 💖

container_selinux — bestie, this is the Security Enhanced Linux Policy for all your container processes 🫶

It lives in the container manual section (that's the (8) in container_selinux(8), iykyk).

✨ DESCRIPTION ✨

So here's the tea ☕: Security-Enhanced Linux locks down your container processes using flexible mandatory access control. Not vibes-based security. Mandatory. She does not negotiate.

Your container processes run under the SELinux type container_t 👑 Wanna check if you've got any of those running? Just run ps with the -Z qualifier, easy.

Like, literally:

ps -eZ | grep container_t

That's it. That's the whole vibe check 🔍

🌈 PROCESS TYPES 🌈

SELinux defines process types (aka domains) for every single process running on your system. Every one. No exceptions, periodt.

You can peep the context of any process using the -Z option to ps 👀

Now, policy governs the access that confined processes have to files. And the SELinux container policy is very flexible, letting users set up their container processes in as secure a way as possible 💅

These are the process types defined for container:

container_runtime_t, container_auth_t, container_userns_t, container_logreader_t, container_logwriter_t, container_kvm_t, container_init_t, container_engine_t, container_device_t, container_device_plugin_t, container_device_plugin_init_t, container_user_t, container_t
📌 Note: semanage permissive -a container_t can be used to make the process type container_t permissive. And like — SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So you'll still see the receipts, she just won't act on them 🙈

🧚 MCS Constrained 🧚

The SELinux process type container_t is an MCS (Multi Category Security) constrained type. Sometimes this separation gets called sVirt. Iconic name, honestly.

These types are usually used for securing multi-tenant environments — think virtualization, containers, or separation of users. The tools used to launch MCS types pick out a different MCS label for each process group ✨

Example time, bestie: one process might get launched with container_t:s0:c1,c2, and another process with container_t:s0:c3,c4. The SELinux kernel only allows these processes to write to content with a matching MCS label, or an MCS label of s0. So a process running at the MCS level of s0:c1,c2 is not allowed to write to content with the MCS label of s0:c3,c4. Boundaries? She has them 💅

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. The container policy is extremely flexible and has several booleans that let you manipulate the policy and run container with the tightest access possible 🔒

  • If you want to allow containers to use any xserver device volume mounted into container, mostly used for GPU acceleration, you must turn on the container_use_xserver_devices boolean. Disabled by default.
setsebool -P container_use_xserver_devices 1
  • If you want to deny any process from ptracing or debugging any other processes, you must turn on the deny_ptrace boolean. Disabled by default.
setsebool -P deny_ptrace 1
  • If you want to allow sandbox containers to use all capabilities, you must turn on the virt_sandbox_use_all_caps boolean. Enabled by default.
setsebool -P virt_sandbox_use_all_caps 1
  • If you want to allow sandbox containers to send audit messages, you must turn on the virt_sandbox_use_audit boolean. Enabled by default.
setsebool -P virt_sandbox_use_audit 1
  • If you want to allow sandbox containers to use netlink system calls, you must turn on the virt_sandbox_use_netlink boolean. Disabled by default.
setsebool -P virt_sandbox_use_netlink 1
  • If you want to allow sandbox containers to use sys_admin system calls — for example mount — you must turn on the virt_sandbox_use_sys_admin boolean. Disabled by default.
setsebool -P virt_sandbox_use_sys_admin 1
  • If you want to allow containers to read shared public files (public_content_t and public_content_rw_t), set the container_read_public_content boolean. Disabled by default.
setsebool -P container_read_public_content 1
  • If you want to allow containers to read and write shared public files (public_content_rw_t), set the container_manage_public_content boolean. Disabled by default.
setsebool -P container_manage_public_content 1

🦋 PORT TYPES 🦋

SELinux defines port types to represent TCP and UDP ports 🛸

Wanna see the types associated with a port? Run this:

semanage port -l

Policy governs the access confined processes have to these ports. And again — SELinux container policy is very flexible, letting users set up their container processes in as secure a way as possible 💜

The following port type is defined for container:

container_port_t

🌸 MANAGED FILES 🌸

The SELinux process type container_t can manage files labeled with the following file types. The paths listed are the default paths for these file types.

⚠️ Heads up bestie: the process's UID still needs to have DAC permissions. SELinux said "I'll handle my layer, you handle yours" 😭
  • bpf_t
/sys/fs/bpf
  • cifs_t
  • container_file_t
/srv/containers(/.*)?
/var/lib/origin(/.*)?
/var/lib/rkt/cas(/.*)?
/var/lib/nerdctl/[^/]*/volumes(/.*)?
/var/lib/buildkit/[^/]*/snapshots(/.*)?
/var/srv/containers(/.*)?
/var/lib/containerd/[^/]*/snapshots(/.*)?
/var/lib/kubernetes/pods(/.*)?
/opt/local-path-provisioner(/.*)?
/var/local-path-provisioner(/.*)?
/var/lib/containers/storage/volumes/[^/]*/.*
/home/[^/]+/.local/share/containers/storage/volumes/[^/]*/.*
  • ecryptfs_t
/home/[^/]+/.Private(/.*)?
/home/[^/]+/.ecryptfs(/.*)?
  • fs_t
  • fusefs_t
/run/user/[0-9]+/gvfs
  • hugetlbfs_t
/dev/hugepages
/usr/lib/udev/devices/hugepages
  • nfs_t
  • onload_fs_t
  • svirt_home_t
/home/[^/]+/.libvirt/qemu(/.*)?
/home/[^/]+/.cache/libvirt/qemu(/.*)?
/home/[^/]+/.config/libvirt/qemu(/.*)?
/home/[^/]+/.local/share/libvirt/boot(/.*)?
/home/[^/]+/.local/share/libvirt/images(/.*)?
/home/[^/]+/.local/share/gnome-boxes/images(/.*)?

📁 FILE CONTEXTS 💾

okay bestie so here's the tea ☕ — SELinux literally requires files to have an extended attribute that defines the file type. like, it's not optional, it's the whole vibe. 🎀

you can peek at the context of a file using the -Z option to ls. go look, it's right there.

Policy governs the access confined processes have to these files. SELinux container policy is very flexible — it lets users set up their container processes in as secure a method as possible. slay. 💅

🔁 EQUIVALENCE DIRECTORIES 🔁

so container policy stores data with multiple different file context types under the /var/lib/buildkit directory. if you would like to store the data in a different directory you can use the semanage command to create an equivalence mapping. if you wanted to store this data under the /srv directory you would execute the following command:

semanage fcontext -a -e /var/lib/buildkit /srv/buildkit
restorecon -R -v /srv/buildkit

container policy stores data with multiple different file context types under the /var/lib/containerd directory. if you would like to store the data in a different directory you can use the semanage command to create an equivalence mapping. if you wanted to store this data under the /srv directory you would execute the following command:

semanage fcontext -a -e /var/lib/containerd /srv/containerd
restorecon -R -v /srv/containerd

container policy stores data with multiple different file context types under the /var/lib/containers directory. if you would like to store the data in a different directory you can use the semanage command to create an equivalence mapping. if you wanted to store this data under the /srv directory you would execute the following command:

semanage fcontext -a -e /var/lib/containers /srv/containers
restorecon -R -v /srv/containers

container policy stores data with multiple different file context types under the /var/lib/docker directory. if you would like to store the data in a different directory you can use the semanage command to create an equivalence mapping. if you wanted to store this data under the /srv directory you would execute the following command:

semanage fcontext -a -e /var/lib/docker /srv/docker
restorecon -R -v /srv/docker

container policy stores data with multiple different file context types under the /var/lib/nerdctl directory. if you would like to store the data in a different directory you can use the semanage command to create an equivalence mapping. if you wanted to store this data under the /srv directory you would execute the following command:

semanage fcontext -a -e /var/lib/nerdctl /srv/nerdctl
restorecon -R -v /srv/nerdctl

container policy stores data with multiple different file context types under the /var/lib/ocid directory. if you would like to store the data in a different directory you can use the semanage command to create an equivalence mapping. if you wanted to store this data under the /srv directory you would execute the following command:

semanage fcontext -a -e /var/lib/ocid /srv/ocid
restorecon -R -v /srv/ocid

🌟 STANDARD FILE CONTEXT 🌟

SELinux defines the file context types for the container, so if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. 👑

semanage fcontext -a -t container_var_lib_t
'/srv/container/content(/.*)?'
restorecon -R -v /srv/mycontainer_content
Note: SELinux often uses regular expressions to specify labels that match multiple files. regex girlies stay winning fr fr ✨

the following file types are defined for container:

🐳 container_auth_exec_t

  • Set files with the container_auth_exec_t type, if you want to transition an executable to the container_auth_t domain.

Paths:

/usr/s?bin/docker-novolume-plugin, /usr/lib/docker/docker-novolume-plugin

⚙️ container_config_t

  • Set files with the container_config_t type, if you want to treat the files as container configuration data, usually stored under the /etc directory.

Paths:

/etc/crio(/.*)?, /etc/docker(/.*)?, /etc/buildkit(/.*)?,
/etc/containerd(/.*)?, /etc/docker-latest(/.*)?

📦 container_file_t

  • Set files with the container_file_t type, if you want to treat the files as container content.

Paths:

/srv/containers(/.*)?, /var/lib/origin(/.*)?,
/var/lib/rkt/cas(/.*)?, /var/lib/nerdctl/[^/]*/volumes(/.*)?,
/var/lib/buildkit/[^/]*/snapshots(/.*)?, /var/srv/containers(/.*)?,
/var/lib/containerd/[^/]*/snapshots(/.*)?,
/var/lib/kubernetes/pods(/.*)?, /opt/local-path-provisioner(/.*)?,
/var/local-path-provisioner(/.*)?,
/var/lib/containers/storage/volumes/[^/]*/.*,
/home/[^/]+/.local/share/containers/storage/volumes/[^/]*/.*

🏠 container_home_t

  • Set files with the container_home_t type, if you want to store container files in the users home directory.

🖥️ container_kvm_var_run_t

  • Set files with the container_kvm_var_run_t type, if you want to store the container kvm files under the /run or /var/run directory.

🔒 container_lock_t

  • Set files with the container_lock_t type, if you want to treat the files as container lock data, stored under the /var/lock directory

📜 container_log_t

  • Set files with the container_log_t type, if you want to treat the data as container log data, usually stored under the /var/log directory.

Paths:

/var/log/lxc(/.*)?, /var/log/lxd(/.*)?, /var/log/pods(/.*)?,
/var/log/containers(/.*)?, /var/log/kube-apiserver(/.*)?,
/var/lib/docker/containers/.*/.*.log, /var/lib/docker-latest/containers/.*/.*.log

🔌 container_plugin_var_run_t

  • Set files with the container_plugin_var_run_t type, if you want to store the container plugin files under the /run or /var/run directory.

🧊 container_ro_file_t

  • Set files with the container_ro_file_t type, if you want to treat the files as container ro content.

Paths:

/var/lib/shared(/.*)?, /var/lib/nerdctl(/.*)?,
/var/lib/docker/.*/config.env, /var/lib/docker/init(/.*)?,
/var/lib/containerd/[^/]*/sandboxes(/.*)?,
/var/lib/docker/overlay(/.*)?, /var/lib/ocid/sandboxes(/.*)?,
/var/lib/docker-latest/.*/config.env,
/var/lib/buildkit/runc-.*/executor(/.*?),
/var/lib/docker/overlay2(/.*)?, /var/lib/kata-containers(/.*)?,
/var/cache/kata-containers(/.*)?,
/var/lib/containers/overlay(/.*)?, /var/lib/docker-latest/init(/.*)?,
/var/lib/docker/containers/.*/hosts,
/var/lib/docker/containers/.*/hostname,
/var/lib/containers/overlay2(/.*)?,
/var/lib/buildkit/containerd-.*(/.*?), /var/lib/docker-latest/overlay(/.*)?,
/var/lib/docker-latest/overlay2(/.*)?,
/var/lib/containers/overlay-images(/.*)?,
/var/lib/containers/overlay-layers(/.*)?,
/var/lib/docker-latest/containers/.*/hosts,
/var/lib/docker-latest/containers/.*/hostname,
/var/lib/containers/overlay2-images(/.*)?,
/var/lib/containers/overlay2-layers(/.*)?,
/var/lib/containers/storage/overlay(/.*)?,
/var/lib/containers/storage/overlay2(/.*)?,
/var/lib/containers/storage/artifacts(/.*)?,
/var/lib/containers/storage/overlay-images(/.*)?,
/var/lib/containers/storage/overlay-layers(/.*)?,
/var/lib/containers/storage/overlay2-images(/.*)?,
/var/lib/containers/storage/overlay2-layers(/.*)?,
/home/[^/]+/.local/share/ramalama(/.*)?,
/home/[^/]+/.local/share/containers/storage/overlay(/.*)?,
/home/[^/]+/.local/share/containers/storage/overlay2(/.*)?,
/home/[^/]+/.local/share/containers/storage/artifacts(/.*)?,
/home/[^/]+/.local/share/containers/storage/overlay-images(/.*)?,
/home/[^/]+/.local/share/containers/storage/overlay-layers(/.*)?,
/home/[^/]+/.local/share/containers/storage/overlay2-images(/.*)?,
/home/[^/]+/.local/share/containers/storage/overlay2-layers(/.*)?

🏃 container_runtime_exec_t

  • Set files with the container_runtime_exec_t type, if you want to transition an executable to the container_runtime_t domain.

Paths:

/usr/s?bin/lxc, /usr/s?bin/lxd, /usr/s?bin/crun, /usr/s?bin/runc,
/usr/s?bin/crio.*, /usr/s?bin/lxc-.*, /usr/s?bin/lxd-.*,
/usr/s?bin/ocid.*, /usr/s?bin/buildah, /usr/s?bin/docker.*,
/usr/s?bin/fuidshift, /usr/s?bin/kata-agent,
/usr/s?bin/buildkitd.*, /usr/s?bin/containerd.*,
/usr/s?bin/buildkit-runc, /usr/s?bin/docker-latest,
/usr/s?bin/docker-current, /usr/local/s?bin/crun,
/usr/local/s?bin/runc, /usr/local/s?bin/crio.*,
/usr/local/s?bin/docker.*, /usr/local/s?bin/kata-agent,
/usr/local/s?bin/buildkitd.*, /usr/local/s?bin/containerd.*,
/usr/local/s?bin/buildkit-runc, /usr/lib/docker/[^/]*plugin,
/usr/libexec/lxc/.*, /usr/libexec/lxd/.*,
/usr/bin/container[^/]*plugin, /usr/libexec/docker/.*,
/usr/local/lib/docker/[^/]*plugin, /usr/libexec/docker/docker.*,
/usr/local/libexec/docker/.*, /usr/local/libexec/docker/docker.*,
/usr/bin/podman, /usr/local/bin/podman, /usr/bin/rhel-push-plugin,
/usr/sbin/rhel-push-plugin

🗑️ container_runtime_tmp_t

  • Set files with the container_runtime_tmp_t type, if you want to store container runtime temporary files in the /tmp directories.

💨 container_runtime_tmpfs_t

  • Set files with the container_runtime_tmpfs_t type, if you want to store container runtime files on a tmpfs file system.

🧩 container_unit_file_t

  • Set files with the container_unit_file_t type, if you want to treat the files as container unit content.

Paths:

/usr/lib/systemd/system/lxd.*, /usr/lib/systemd/system/docker.*,
/usr/lib/systemd/system/buildkit.*,
/usr/lib/systemd/system/containerd.*

🗄️ container_var_lib_t

  • Set files with the container_var_lib_t type, if you want to store the container files under the /var/lib directory.

Paths:

/exports(/.*)?, /var/lib/cni(/.*)?, /var/lib/lxc(/.*)?,
/var/lib/lxd(/.*)?, /var/lib/crio(/.*)?, /var/lib/ocid(/.*)?,
/var/lib/docker(/.*)?, /var/lib/kubelet(/.*)?,
/var/lib/buildkit(/.*)?, /var/lib/registry(/.*)?,
/var/lib/containerd(/.*)?, /var/lib/containers(/.*)?,
/var/cache/containers(/.*)?, /var/lib/docker-latest(/.*)?

🌀 container_var_run_t

  • Set files with the container_var_run_t type, if you want to store the container files under the /run or /var/run directory.

Paths:

/run/crio(/.*)?, /run/docker(/.*)?, /run/flannel(/.*)?,
/run/buildkit(/.*)?, /run/containerd(/.*)?, /run/containers(/.*)?,
/run/docker-client(/.*)?, /run/docker.pid, /run/docker.sock
Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. no shortcuts bestie, the database is the database 💖

💅 COMMANDS 💅

ok so real talk — this manpage is like the lore, but if you wanna actually do stuff, these are the tools you're gonna be living in. Go off:

  • semanage fcontext — this one's for messing with the default file context mappings. Your fcontext bestie, fr fr.
  • semanage permissive — flips a process type between permissive and not-permissive. Use it wisely 👀
  • semanage module — enable / disable / install / remove policy modules. The whole module lifecycle, periodt.
  • semanage port — yes babes, this is how you manipulate the port definitions.
  • semanage boolean — and this is how you manipulate the booleans. (The BOOLEANS section above is literally the receipts 💖)
  • system-config-selinux — a GUI tool that's available to customize SELinux policy settings. Not a girlie who loves the terminal 24/7? No judgement, this one's for you 🎀

🫶 AUTHOR 🫶

This manual page was auto-generated using sepolicy manpage.

not me getting a whole manpage written about me by a robot ✨ no human author to credit, the tool did the heavy lifting, and honestly? slay.

🌈 SEE ALSO 🌈

the whole extended family, right here. Every single one, no skips — and yes bestie, some of them are listed twice, that's just how the original rolls 💀:

  • selinux(8)
  • container(8)
  • semanage(8)
  • restorecon(8)
  • chcon(1)
  • sepolicy(8)
  • setsebool(8)
  • container_auth_selinux(8)
  • container_auth_selinux(8)
  • container_device_selinux(8)
  • container_device_selinux(8)
  • container_device_plugin_selinux(8)
  • container_device_plugin_selinux(8)
  • container_device_plugin_init_selinux(8)
  • container_device_plugin_init_selinux(8)
  • container_engine_selinux(8)
  • container_engine_selinux(8)
  • container_init_selinux(8)
  • container_init_selinux(8)
  • container_kvm_selinux(8)
  • container_kvm_selinux(8)
  • container_logreader_selinux(8)
  • container_logreader_selinux(8)
  • container_logwriter_selinux(8)
  • container_logwriter_selinux(8)
  • container_runtime_selinux(8)
  • container_runtime_selinux(8)
  • container_user_selinux(8)
  • container_user_selinux(8)
  • container_userns_selinux(8)
  • container_userns_selinux(8)

okay that's the whole page, start to finish, and you ate it 💅 go forth and be secure, bestie 🦋

📌 lil' footnote for the record books: this came from container version 25-03-11 and it's the container_selinux(8) page — dated 25-03-11, so jot that down if you ever need to cite your sources like the academic queen you are 👑✨
📦 where this page comes from