selinux issues after f39-f40 upgrade

[cgwalters]

Looks like #3234 came back for me. I upgraded from f39 to f40 (a bootc host, but I don't think it's relevant). Now I get this trying to launch most of my containers:

Mar 28 20:31:50 xenon audit[4873]: AVC avc:  denied  { read } for  pid=4873 comm="sh" path="/usr/lib64/libc.so.6" dev="nvme0n1p3" ino=110934960 scontext=system_u:system_r:container_t:s0:c293,c754 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0

I haven't touched the labels for a while.

$ rpm -q podman container-selinux
podman-5.0.0-1.fc40.x86_64
container-selinux-2.230.0-1.fc40.noarch

[rhatdan]

Did container selinux blow up on install?
dnf reinstall container-selinux

[cgwalters]

This is a bootc host 😄 The labels are always right for the host, there's no need to reinstall container-selinux. Something seems off I guess with labels in my home directory? But actually at least part of this may have been because when I was trying to work on some podman tests, the test script set HOME to the git directory and I think that may have confused things.

I'm still debugging, I also ran straight into the pasta/rootful issue.

[rhatdan]

Basically the default path for $HOME/.share/local/containers/storage does not have the correct SELinux labels setup for it.