docs: clarify SELinux domain runtime guidance

acl/SPECS/selinux-policy/0061-container-Allow-log-reader-to-map-journals.patch

@@ -0,0 +1,32 @@
+From 1b6a1a2c7836d3601b7af8ac453f9b89163eda3a Mon Sep 17 00:00:00 2001
+From: Sean Dougherty <sdougherty@microsoft.com>
+Date: Fri, 21 Aug 2026 22:12:09 +0000
+Subject: [PATCH] container: Allow log reader to map journals
+
+Journal readers such as journalctl memory-map systemd journal files. Grant the
+existing read-only journal interface so container_logreader_t can consume
+persistent journals without receiving write or watch access.
+
+Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
+---
+ policy/modules/services/container.te | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
+index 2fe1b51..4559fb5 100644
+--- a/policy/modules/services/container.te
++++ b/policy/modules/services/container.te
+@@ -614,6 +614,10 @@ logging_list_logs(container_logreader_t)
+ allow container_logreader_t logfile:lnk_file read_lnk_file_perms;
+ allow container_logreader_t container_log_t:file watch;
+
++optional_policy(`
++	systemd_read_journal_files(container_logreader_t)
++')
++
+ ########################################
+ #
+ # Common container engine local policy
+-- 
+2.45.4
+

acl/SPECS/selinux-policy/selinux-policy.spec

@@ -10,7 +10,7 @@
 Summary:        SELinux policy
 Name:           selinux-policy
 Version:        %{refpolicy_major}.%{refpolicy_minor}
-Release:        9%{?dist}
+Release:        10%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -81,6 +81,7 @@ Patch57:        0057-cloudinit-Add-sys_admin-to-set-security.sehash.patch
 Patch58:        0058-sysnetwork-Silence-sys_admin-denials.patch
 Patch59:        0059-container-Drop-unqualified-etc-dir-filetrans-to-conta.patch
 Patch60:        0060-container-Add-log-reader-domain.patch
+Patch61:        0061-container-Allow-log-reader-to-map-journals.patch
 BuildRequires:  bzip2
 BuildRequires:  checkpolicy >= %{CHECKPOLICYVER}
 BuildRequires:  m4
@@ -359,6 +360,9 @@ exit 0
 selinuxenabled && semodule -nB
 exit 0
 %changelog
+* Fri Aug 21 2026 Sean Dougherty <sdougherty@microsoft.com> - 2.20250213-10
+- Allow confined container log readers to map systemd journal files.
+
 * Wed Aug 19 2026 Sean Dougherty <sdougherty@microsoft.com> - 2.20250213-9
 - Add a confined container log reader domain.
 

acl/docs/README.md

@@ -9,6 +9,7 @@ Detailed documentation for Azure Container Linux.
 | [Platforms](platforms.md)       | Supported platforms and OEM packages                                         |
 | [Testing](testing.md)           | Kola/Mantle framework, test categories, enforcing tests                      |
 | [Kdump](kdump.md)               | Enabling crash dump (kdump) collection via the UKI addon                     |
+| [SELinux](selinux.md)           | Container workload domains, privilege boundaries, and selection guidance     |
 
 ## Operational Guides
 

acl/docs/architecture.md

@@ -84,4 +84,4 @@ The ROOT partition is created at a minimal size in the shipped image. On first b
 
 ### SELinux
 
-ACL ships with **SELinux in enforcing mode by default**. The policy is aligned with Flatcar's upstream SELinux policy, which focuses on strict separation between the host OS and container workloads — host system services run in confined domains while containers are isolated by the `container_t` type.
+ACL ships with **SELinux in enforcing mode by default**. The policy is aligned with Flatcar's upstream SELinux policy, which focuses on strict separation between the host OS and container workloads — host system services run in confined domains while containers are isolated by the `container_t` type. See [SELinux Container Domains](selinux.md) for specialized workload domains and safe configuration examples.