SELinux doesn't contain Docker containers

[tjdett]

On a clean 845.0, following:

rm /etc/audit/rules.d/80-selinux.rules
rm /etc/audit/rules.d/99-default.rules
rm /var/lib/selinux; cp -a /usr/lib/selinux/policy /var/lib/selinux
rm /etc/selinux/mcs; cp -a /usr/lib/selinux/mcs /etc/selinux/
semodule -DB
systemctl restart audit-rules
setenforce 1
systemctl restart docker

Docker runs as kernel_t:

$ ps -efZ | grep docker
system_u:system_r:kernel_t:s0   root      1792     1  0 04:04 ?        00:00:00 docker daemon --host=fd://

and as a result Docker containers are unrestricted in their access to the filesystem:

$ getenforce && docker run -ti --rm -v /etc:/mnt/etc alpine:3.2 sh -c "echo foo > /mnt/etc/test" && cat /etc/test
Enforcing
foo

[crawford]

Looks like a duplicate of #961.