Allow container_runtime_domain runtime fifo_files transition

[zpytela]

Seems to be triggered by
bats -t -f "podman kill - test signal handling in containers" test/system/130-kill.bats

The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(03/17/25 12:12:47.095:1509) : proctitle=nft -j -f - type=EXECVE msg=audit(03/17/25 12:12:47.095:1509) : argc=4 a0=nft a1=-j a2=-f a3=- type=SYSCALL msg=audit(03/17/25 12:12:47.095:1509) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x7f97e2882d70 a1=0x560887444100 a2=0x7ffdee1af598 a3=0x8 items=0 ppid=13726 pid=13733 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=16 comm=nft exe=/usr/sbin/nft subj=unconfined_u:unconfined_r:iptables_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(03/17/25 12:12:47.095:1509) : avc: denied { write } for pid=13733 comm=nft path=/tmp/podman_bats.vMhYNp/podman-kill-fifo.CMSpDDvE0M dev="xvda3 ino=377487601 scontext=unconfined_u:unconfined_r:iptables_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=fifo_file permissive=0

Related: RHEL-83775

Summary by Sourcery

Bug Fixes:

• Permit the container runtime domain to interact with temporary FIFO files to fix SELinux denials seen in podman kill signal-handling tests.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Allows the container runtime SELinux domain to transition fifo_file objects in runtime contexts, resolving an AVC denial seen during podman kill signal-handling tests by updating container.te policy rules and the corresponding container.if interface.

File-Level Changes

Change	Details	Files
Permit container_runtime_domain to transition and access runtime fifo_files to fix podman kill AVC denials.	Add or adjust SELinux type transition/allow rules so container_runtime_domain can write to fifo_file objects created in runtime/tmp locations Expose the new permission pattern through the container.if interface for reuse by other modules or callers Align the policy change with the AVC details from the nft/iptables_t execution path seen in bats podman kill tests	container.te container.if

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[gemini-code-assist]

Summary of Changes

Hello @zpytela, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an SELinux AVC denial that prevented container runtime processes from writing to FIFO files in temporary directories, specifically observed during podman kill operations. The changes involve updating the SELinux policy by introducing a new interface to permit writing to PID-related FIFO files and extending existing temporary file transition rules to explicitly include FIFO files. This ensures that container processes can correctly manage FIFO files without encountering permission issues, thereby improving the robustness and security context handling of the container runtime.

Highlights

• SELinux Policy Update: The SELinux policy has been updated to resolve an Access Vector Cache (AVC) denial that occurred when the nft command attempted to write to FIFO files within temporary directories, specifically addressing an issue triggered during Podman kill signal handling tests.
• New Interface for FIFO File Writes: A new SELinux interface, container_write_pid_fifo_files, has been introduced. This interface explicitly allows specified domains to write to PID-related FIFO files within the container_var_run_t context, enhancing flexibility for container runtime operations.
• Temporary File Transition for FIFO Files: The files_tmp_filetrans rule for container_runtime_domain has been extended to include fifo_file types. This modification enables proper handling and creation of FIFO files in temporary locations by container runtime processes, directly addressing the reported AVC denial.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• The denial is specifically about iptables_t writing a fifo under user_tmp_t; if the rule currently broadens fifo_file transitions for container_runtime_domain in general, consider scoping it to the minimal relevant types/contexts (e.g., container tmp types or a dedicated fifo type) to avoid over-permissive policy.
• Please add a brief policy comment near the new allow/transition rule that references the AVC snippet or RHEL-83775 so that future maintainers understand why fifo_files need this special handling for podman kill signal tests.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The denial is specifically about iptables_t writing a fifo under user_tmp_t; if the rule currently broadens fifo_file transitions for container_runtime_domain in general, consider scoping it to the minimal relevant types/contexts (e.g., container tmp types or a dedicated fifo type) to avoid over-permissive policy.
- Please add a brief policy comment near the new allow/transition rule that references the AVC snippet or RHEL-83775 so that future maintainers understand why fifo_files need this special handling for podman kill signal tests.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request aims to fix an AVC denial that occurs during podman kill tests. It correctly identifies that FIFO files created by container_runtime_domain need a specific SELinux type and adds rules for that. A new interface, container_write_pid_fifo_files, is also introduced to allow writing to these FIFO files.

The changes are on the right track, but I've identified a critical omission. The new interface is defined but not actually used for the iptables_t domain, which is what the AVC denial indicates needs write access. Without this, the fix is incomplete. My review includes a specific suggestion to resolve this.

[packit-as-a-service]

Tests failed. @containers/packit-build please check.

[lsm5]

Hey @zpytela , could you please signoff on your commit?