[test] add custom selinux rules

For containers/container-selinux#274.

Signed-off-by: Kir Kolyshkin <[email protected]>

contrib/test/ci/build/runc.yml

@@ -21,3 +21,7 @@
     dest: /usr/bin/runc
     state: link
     force: yes
+
+- name: load custom selinux rules
+  shell: scripts/mod-selinux.sh
+    chdir: "{{ ansible_env.GOPATH }}/src/github.com/cri-o/cri-o"

scripts/mod-selinux.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+cat <<EOF >local.te
+module local 1.0;
+
+require {
+	type container_runtime_tmpfs_t;
+	type container_t;
+	class file { entrypoint execute map read };
+}
+
+#============= container_t ==============
+allow container_t container_runtime_tmpfs_t:file entrypoint;
+allow container_t container_runtime_tmpfs_t:file map;
+allow container_t container_runtime_tmpfs_t:file { execute read };
+EOF
+
+# Compile the module.
+checkmodule -M -m -o local.mod local.te
+
+# Create the package.
+semodule_package -o local.pp -m local.mod
+
+# Load the module into the kernel.
+sudo semodule -i local.pp