From 49b7c73f4c2f600ab21d3829b6deea86871aa6bd Mon Sep 17 00:00:00 2001
From: AlmaLinux RelEng Bot <eabdullin@almalinux.org>
Date: Tue, 30 Jun 2026 16:39:01 -0400
Subject: [PATCH] import CS git container-selinux-2.229.0-3.el8

---
 ...er_t-confined-user-container-support.patch | 45 +++++++++++++++++++
 SPECS/container-selinux.spec                  |  7 ++-
 2 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 SOURCES/0001-user_t-confined-user-container-support.patch

diff --git a/SOURCES/0001-user_t-confined-user-container-support.patch b/SOURCES/0001-user_t-confined-user-container-support.patch
new file mode 100644
index 0000000..5254c6d
--- /dev/null
+++ b/SOURCES/0001-user_t-confined-user-container-support.patch
@@ -0,0 +1,45 @@
+--- a/container.te	2026-05-05 09:32:59.765043395 +0200
++++ b/container.te	2026-05-05 09:33:51.969040483 +0200
+@@ -68,6 +68,15 @@
+ ## </desc>
+ gen_tunable(container_use_ecryptfs, false)
+ 
++## <desc>
++##  <p>
++##  Allow user_t confined users to run podman containers.
++##  Disabled by default since user_t is the most restricted
++##  confined user type.
++##  </p>
++## </desc>
++gen_tunable(user_t_run_containers, false)
++
+ attribute container_runtime_domain;
+ container_runtime_domain_template(container_runtime)
+ typealias container_runtime_t alias docker_t;
+@@ -1272,13 +1281,25 @@
+ 	allow userdomain self:cap_userns ~{ sys_module };
+ 	container_read_state(userdomain)
+ 	allow userdomain container_runtime_t:process { noatsecure rlimitinh siginh };
+-	container_runtime_run(user_t, user_r)
++	role user_r types container_runtime_t;
+ 	role user_r types container_user_domain;
+ 
+ 	staff_role_change_to(system_r)
++	unprivuser_role_change_to(system_r)
+ 
+ 	allow staff_t container_runtime_t:process signal_perms;
+ 	allow staff_t container_domain:process signal_perms;
++
++	# Allow confined user systemd instances to create and manage sockets
++	# for podman.socket activation (user-level systemd pre-labels the
++	# socket as container_runtime_t via setsockcreatecon)
++	allow { staff_t user_t } container_runtime_t:unix_stream_socket { create bind listen getattr setopt };
++
++	tunable_policy(`user_t_run_containers',`
++		container_runtime_domtrans(user_t)
++		allow user_t container_runtime_t:process signal_perms;
++		allow user_t container_domain:process signal_perms;
++	')
+ 	allow container_domain userdomain:socket_class_set { accept ioctl read getattr lock write append getopt shutdown setopt };
+ ')
+ 
diff --git a/SPECS/container-selinux.spec b/SPECS/container-selinux.spec
index c7278bb..38ae7cd 100644
--- a/SPECS/container-selinux.spec
+++ b/SPECS/container-selinux.spec
@@ -20,11 +20,12 @@
 Epoch: 2
 Name: container-selinux
 Version: 2.229.0
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: GPLv2
 URL: %{git0}
 Summary: SELinux policies for container runtimes
 Source0: %{git0}/archive/v%{version}.tar.gz
+Patch0: 0001-user_t-confined-user-container-support.patch
 BuildArch: noarch
 BuildRequires: git
 BuildRequires: pkgconfig(systemd)
@@ -123,6 +124,10 @@ fi
 %{_datadir}/udica/templates/*
 
 %changelog
+* Tue May 05 2026 Jindrich Novy <jnovy@redhat.com> - 2:2.229.0-3
+- add user_t confined user container support (cherry-pick of upstream PR #443)
+- Resolves: RHEL-135342
+
 * Tue Jan 23 2024 Jindrich Novy <jnovy@redhat.com> - 2:2.229.0-2
 - remove watch statements properly for RHEL8 and lower
 - Related: Jira:RHEL-2110