It tries to find an issue related to spc_t and container_t domains where target class is dir or file.
rebased onto 8edc417559e0a0ced056be393abe15266284eb84
There is still one problem with fix button there. If you click on button the AVCs are appeared. It probably has a problem with semanage fcontext.
Why it's split to 2 lines?
Do you plan to add other classes supported by udica policies?
If you use podman you can use :z or :Z suffix for volume mounts, see podman-run(1):
podman
:z
:Z
podman-run(1)
Labeling Volume Mounts Labeling systems like SELinux require that proper labels are placed on volume content mounted into a con‐ tainer. Without a label, the security system might prevent the processes running inside the container from using the content. By default, Podman does not change the labels set by the OS. To change a label in the container context, you can add either of two suffixes :z or :Z to the volume mount. These suffixes tell Podman to relabel file objects on the shared volumes. The z option tells Podman that two containers share the volume content. As a result, Podman labels the content with a shared content label. Shared volume labels allow all containers to read/write content. The Z option tells Podman to label the con‐ tent with a private unshared label.
It would be great to have some real world examples or references either in commit message or directly as part of comment in the plugin. Also I'd interested why semanage fcontext is the suggested as a solution .
semanage fcontext
Here I've got a fix command and after click it should be executed. After I click on the button I can see pop-up window with message "usage:semanage [-h]"and AVCs: time->Tue Mar 23 17:55:27 2021 type=AVC msg=audit(1616518527.775:12425): avc: denied { execute } for pid=2431194 comm="sealert" name="semanage" dev="dm-1" ino=4083504 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1
time->Tue Mar 23 17:55:27 2021 type=AVC msg=audit(1616518527.775:12426): avc: denied { read open } for pid=2431194 comm="sealert" path="/usr/sbin/semanage" dev="dm-1" ino=4083504 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1
time->Tue Mar 23 17:55:27 2021 type=AVC msg=audit(1616518527.775:12427): avc: denied { execute_no_trans } for pid=2431194 comm="sealert" path="/usr/sbin/semanage" dev="dm-1" ino=4083504 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1
time->Tue Mar 23 17:55:27 2021 type=AVC msg=audit(1616518527.789:12428): avc: denied { ioctl } for pid=2431194 comm="semanage" path="/usr/sbin/semanage" dev="dm-1" ino=4083504 ioctlcmd=0x5451 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1
Pull-Request has been closed by rfilo
It tries to find an issue related to spc_t and container_t domains where target class is dir or file.