Supplying custom selinux policies in a package

[ctrox]

Hi, I'm trying to get zeropod or more specifically criu to run on bottlerocket and I'm running into some selinux denials. Is it possible to create a package that adds selinux policies? I managed to get everything running by forking bottlerocket-core-kit and adding my policy to packages/selinux-policy/ but I don't really want to maintain that as even just building the core kit is quite heavy.

I found this issue which lead me to believe that it might not be possible but maybe something changed in the meantime?

[ctrox]

One thing that seems to work is just copying packages/selinux-policy into my variation and modify it. It appears to take precedence over the selinux-policy that is in the upstream bottlerocket-core-kit. But would be nice to know if this is a a bad idea for some reason or if there's a better way to do this.