fix: allow CSI volumes to be mounted with an SELinux context

CSI-provisioned volumes are mounted by the driver through kubelet, outside
Talos's mount manager, so nothing labels their contents and they come out
unlabeled_t. Operators can request a label through StorageClass mountOptions,
which reaches the driver's mount call, but the mount syscall relabels the
filesystem away from fs_t, and pod_p is not permitted relabelfrom on it. Under
enforcing the mount fails and the volume is unusable.

Grant pod_p relabelfrom on fs_t. The target type is already covered by the
existing ephemeral_t fs_classes grant, which maps to the filesystem class too.

Fixes #14182

Signed-off-by: Ivan Demchuk <ivan.demchuk@gmail.com>
Signed-off-by: Dmitrii Sharshakov <dmitry.sharshakov@siderolabs.com>

Author: Demivan

internal/pkg/selinux/policy/policy.33

@@ -217,7 +217,10 @@
     mount
     quotaget
     quotamod
-    ; relabelfrom
+    ; CSI drivers mount volumes with an explicit context=, requested through StorageClass
+    ; mountOptions, and the mount syscall relabels the filesystem away from fs_t. The target
+    ; type is covered by the ephemeral_t fs_classes grant below.
+    relabelfrom
     ; relabelto
     remount
     unmount