{"action":"created","issue":{"url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/166","repository_url":"https://api.github.com/repos/fedora-selinux/selinux-policy","labels_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/166/labels{/name}","comments_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/166/comments","events_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/166/events","html_url":"https://github.com/fedora-selinux/selinux-policy/pull/166","id":181693386,"number":166,"title":"Change container_image_t to container_file_t","user":{"login":"rhatdan","id":2000835,"avatar_url":"https://avatars.githubusercontent.com/u/2000835?v=3","gravatar_id":"","url":"https://api.github.com/users/rhatdan","html_url":"https://github.com/rhatdan","followers_url":"https://api.github.com/users/rhatdan/followers","following_url":"https://api.github.com/users/rhatdan/following{/other_user}","gists_url":"https://api.github.com/users/rhatdan/gists{/gist_id}","starred_url":"https://api.github.com/users/rhatdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhatdan/subscriptions","organizations_url":"https://api.github.com/users/rhatdan/orgs","repos_url":"https://api.github.com/users/rhatdan/repos","events_url":"https://api.github.com/users/rhatdan/events{/privacy}","received_events_url":"https://api.github.com/users/rhatdan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-07T15:07:58Z","updated_at":"2016-10-07T15:12:03Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/166","html_url":"https://github.com/fedora-selinux/selinux-policy/pull/166","diff_url":"https://github.com/fedora-selinux/selinux-policy/pull/166.diff","patch_url":"https://github.com/fedora-selinux/selinux-policy/pull/166.patch"},"body":"Also add container_ro_file_t, for a type that can be shared into a container\r\nas r/o/x permissions, but no write."},"comment":{"url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/comments/252278798","html_url":"https://github.com/fedora-selinux/selinux-policy/pull/166#issuecomment-252278798","issue_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/166","id":252278798,"user":{"login":"rhatdan","id":2000835,"avatar_url":"https://avatars.githubusercontent.com/u/2000835?v=3","gravatar_id":"","url":"https://api.github.com/users/rhatdan","html_url":"https://github.com/rhatdan","followers_url":"https://api.github.com/users/rhatdan/followers","following_url":"https://api.github.com/users/rhatdan/following{/other_user}","gists_url":"https://api.github.com/users/rhatdan/gists{/gist_id}","starred_url":"https://api.github.com/users/rhatdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhatdan/subscriptions","organizations_url":"https://api.github.com/users/rhatdan/orgs","repos_url":"https://api.github.com/users/rhatdan/repos","events_url":"https://api.github.com/users/rhatdan/events{/privacy}","received_events_url":"https://api.github.com/users/rhatdan/received_events","type":"User","site_admin":false},"created_at":"2016-10-07T15:12:03Z","updated_at":"2016-10-07T15:12:03Z","body":"Also we need container_ro_t to be exposed inside of /etc/selinux/targeted/contexts/lxc_contexts \r\n\r\n```\r\ncat /etc/selinux/targeted/contexts/lxc_contexts \r\nprocess = \"system_u:system_r:svirt_lxc_net_t:s0\"\r\ncontent = \"system_u:object_r:virt_var_lib_t:s0\"\r\nfile = \"system_u:object_r:svirt_sandbox_file_t:s0\"\r\nsandbox_kvm_process = \"system_u:system_r:svirt_qemu_net_t:s0\"\r\nsandbox_kvm_process = \"system_u:system_r:svirt_qemu_net_t:s0\"\r\nsandbox_lxc_process = \"system_u:system_r:svirt_lxc_net_t:s0\"\r\n```\r\nThis needs to become\r\n\r\n```\r\nprocess = \"system_u:system_r:svirt_lxc_net_t:s0\"\r\ncontent = \"system_u:object_r:virt_var_lib_t:s0\"\r\nfile = \"system_u:object_r:svirt_sandbox_file_t:s0\"\r\nsandbox_kvm_process = \"system_u:system_r:svirt_qemu_net_t:s0\"\r\nsandbox_kvm_process = \"system_u:system_r:svirt_qemu_net_t:s0\"\r\nsandbox_lxc_process = \"system_u:system_r:svirt_lxc_net_t:s0\"\r\n```\r\n Needs to become:\r\n```\r\nprocess = \"system_u:system_r:container_t:s0\"\r\ncontent = \"system_u:object_r:virt_var_lib_t:s0\"\r\nfile = \"system_u:object_r:container_file_t:s0\"\r\nro_file=\"system_u:object_r:container_ro_file_t:s0\"\r\nsandbox_kvm_process = \"system_u:system_r:svirt_qemu_net_t:s0\"\r\nsandbox_kvm_process = \"system_u:system_r:svirt_qemu_net_t:s0\"\r\nsandbox_lxc_process = \"system_u:system_r:container_t:s0\"\r\n```"}}
{"actor":{"display_login":"rhatdan"}}