docs: document SELinux container domains

[SeanDougherty]

Summary

Add a customer-facing reference for every workload-selectable SELinux container domain shipped by ACL. The guide helps teams choose purpose-built confined domains instead of defaulting to spc_t.

This PR now targets aclmain directly and includes the reviewed runtime-guidance changes previously tracked in #63; #63 is superseded.

Change Log

• Document container_t, container_logreader_t, container_kvm_t, spc_t, and spc_user_t.
• Add decision and capability matrices for policy scope, MCS isolation, log/audit access, KVM policy, and privileged behavior.
• Document CRI enableSelinux, single- and multi-container MCS considerations, and collision-free allocation requirements.
• Add usable Kubernetes guidance, including effective journal-file DAC group discovery for non-root collectors.
• Document sequential-only audit-file reads, suppressed mmap denials, and dontaudit troubleshooting on development images.
• Identify Docker, CRI-O, and Podman infrastructure domains and object types that must not be selected as workload domains.
• Document the svirt_lxc_net_t alias and shipped-but-undefined container_init_t context.
• Add guidance for requesting a narrow policy domain instead of accumulating spc_t permissions.

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

• Builds on merged selinux-policy: complete container log reader support #59
• Supersedes docs: clarify SELinux domain runtime guidance #63
• Azure Boards: AB#23415

Test Methodology

• Rebuilt as one docs commit directly on the selinux-policy: complete container log reader support #59 merge commit to remove all stacked-branch conflicts.
• Cross-checked the five workload domains and system/user, MCS, privileged, and stock-unconfined memberships against compiled selinux-policy-2.20250213-10 CIL.
• Verified container_kvm_t, audit read/no-map, journal read/map, and direct spc_t module-loading semantics against source and packaged policy.
• Verified CRI enableSelinux, runtime type/MCS assignment, and host-log reads on the ACL validation image.
• Verified effective journal DAC ownership and replaced the previously assumed fixed GID with host-side numeric discovery.
• Checked containerd 2.2.4 MCS label allocation behavior and documented collision-safe guidance.
• Independent final reviews found no blocking issues.

Merge Checklist

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[SeanDougherty]

Applied the independent review findings in 0e82262: clarified the exact container_kvm_t delta and device requirements, scoped the Kubernetes type-only example and documented multi-container MCS allocation, corrected the common non-log access boundary, stated stock spc_t/spc_user_t unconfined behavior, added Podman infrastructure domains, and called out the shipped-but-undefined container_init_t context. Revalidated against release-11 CIL and containerd 2.2.4; an independent follow-up review found no remaining issues.

[Jiri Appl (jiria)]

Read through this carefully against the policy sources — it's a genuinely high-quality doc, and the verification methodology in the description is more rigorous than most. The workload-vs-engine/helper-domain split is a distinction people routinely get wrong, and it's handled well here. Tables using text markers alongside colour is a nice touch too.

I spot-checked the factual claims and the following all hold up: the crictl ... info | jq -r '.config.enableSelinux' path for containerd 2.x, enable_selinux = true in the shipped containerd config, persistent journal storage under /var/log/journal, the container_logreader_t grant set, svirt_lxc_net_t as a container_t alias, container_runtime_t as a file type, the container_kvm_t specifics, the engine-scope and MCS-constrained columns, the MCS dominance reasoning, and containerd allocating a fresh MCS level when the level is omitted.

I also went and checked the "five workload process domains" count and the container_init_t statement, since those are the hardest claims for a reader to verify — both are correct for RELEASE_2_20250213. (Flagging that only because an automated pass against refpolicy main disagrees, where container_init was added after the shipped release. Might be worth a version anchor in the text to save the next person the same detour.)

Five comments below. Two I'd actually like a response on (the spc_t module-loading attribution, and DAC in the journal validation step); the rest are low-priority or take-or-leave. Not blocking — this is already approved and I don't want to hold it up.

[SeanDougherty]

Addressed the latest review in 682baf6. In addition to the inline fixes, the guide now anchors the five-domain inventory and undefined container_init_t note to the shipped selinux-policy-2.20250213-10 release, avoiding ambiguity with newer upstream refpolicy.

[Copilot]

Pull request overview

Adds a customer-facing reference for ACL’s workload-selectable SELinux container domains, focusing on helping operators choose the narrowest appropriate domain instead of defaulting to privileged spc_t.

Changes:

• Reworks selinux.md into a domain selection and reference guide covering container_t, container_logreader_t, container_kvm_t, spc_t, and spc_user_t.
• Adds decision/capability matrices plus Kubernetes-focused domain selection and MCS isolation guidance.
• Updates the docs index entry to reflect the new SELinux guide scope.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
acl/docs/selinux.md	Expands into a full SELinux container domain reference with selection guidance, capability comparison, and operational examples.
acl/docs/README.md	Updates the SELinux docs row description to match the expanded guide.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[SeanDougherty]

Rebuilt this PR directly on the merged #59 aclmain commit as one docs-only commit (85a47002ca). It now includes the reviewed changes previously tracked in #63 plus the later audit mmap, DAC, mount-validation, and suppressed-denial guidance. The PR is conflict-free; #63 is superseded.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[SeanDougherty]

Jiri Appl (@jiria) Nikola Bojanic (@nbojanic) The conflict-free replacement now folds the #63 follow-ups directly into #60. It is one docs-only commit on merged aclmain; #63 is closed as superseded. All earlier feedback is incorporated, including the later audit mmap, journal DAC, mount-validation, and dontaudit troubleshooting notes. Please reapprove when ready; the protected merge is waiting on code-owner review and refreshed CI.