selinux: run virt-handler without categories
Not having categories in the virt-handler allows us to greatly
simplify the tap making solution, since it allows the process that
creates the tap device (which runs with virt-launcher's categories)
to access the clone device available on virt-handler.
@@ -402,6 +402,9 @@ func NewHandlerDaemonSet(namespace string, repository string, imagePrefix string
}
container.SecurityContext = &corev1.SecurityContext{
Privileged: boolPtr(true),
+ SELinuxOptions: &corev1.SELinuxOptions{
+ Level: "s0",
+ },
}
containerEnv := []corev1.EnvVar{
{
