Feature: Allow container_s to execute local_t

[pengubco]

What I'd like:
Allow a container to execute binaries labeled with local_t.

(allow container_s local_t (file (entrypoint)))

Any alternatives you've considered:
I've been manually settings binaries to cache_t.

[bcressey]

I don't recall offhand why this isn't allowed; I'll need to think about it.

[pengubco]

Is the following thinking correct?

In my case, the container runtime run as system_t and containerd runs as runtime_t. Both system_t and runtime_t can relabel files from local_t to data_t. So if I have a local_t file, I can already execute it by relabeling it to data_t in my container runtime. Therefore, letting container execute data_t directly does not break existing security.

bash-5.2# ps -Z $(pidof containerd)
LABEL                               PID TTY      STAT   TIME COMMAND
system_u:system_r:runtime_t:s0     1181 ?        Ssl    0:38 /usr/bin/containerd

sesearch -A -s runtime_t -t local_t -c file -p relabelto policy.31
allow trusted_s global:file { mounton quotaon relabelfrom relabelto };

sesearch -A -s runtime_t -t data_t -c file -p relabelto policy.31
allow trusted_s global:file { mounton quotaon relabelfrom relabelto };