The C-0211 SELinux fill writes a bare level:s0, which would flatten runtime MCS categories on an SELinux node #3477

🤖 Generated by the Agentic Engineer

Evidence

add-security-context supplies the C-0211 SELinux field by writing a literal level: s0 — at
container scope for pods that declare no pod-level SELinux object, and (as of #3460) at pod scope
where the pod-level object exists but carries no level.

On a SELinux-enforcing node the container runtime assigns each container its own MCS category pair,
producing a level such as s0:c12,c19. Those categories are what keep two containers on the same
node from reading each other's labelled files. Writing a bare, category-free s0 replaces the
runtime-assigned level, so every mutated container would share one level and lose that isolation.

Why this is not urgent, and not dismissable either

It is inert today: every node is Talos v1.13.9, which enforces AppArmor rather than SELinux, so
no MCS categories are being assigned for s0 to overwrite. Measured 2026-08-30 on oidc@prod: all
nodes report Talos (v1.13.9), and zero pods cluster-wide declare a pod-level seLinuxOptions.

But the policy presents the setting as defence-in-depth for SELinux nodes, which is precisely the
case where the current value would weaken isolation rather than add to it. So this is a latent
correctness gap that activates silently on a node-OS change — the kind that is cheap now and
expensive to discover later.

Affected audience and impact

Operators of any future SELinux-enforcing node pool in this cluster. Impact is a weakened
same-node isolation boundary between containers in the opted-in namespaces, with no signal that
anything changed.

Acceptance criteria

• Decide the policy's behaviour on SELinux-enforcing nodes: either stop writing level where the
  runtime would assign one, narrow the mutation to node pools known not to enforce SELinux, or
  record an explicit accepted-risk with the reasoning in the policy itself.
• Whichever path is chosen, the policy carries a comment stating what happens on an SELinux node,
  so the next reader does not have to re-derive it.
• A test pins the chosen behaviour in both states.

Size

Small — a decision plus a scoped policy change and one fixture. The investigation is already done
here; what remains is the call and its coverage.

Raised from a Codex P2 review finding on #3460, where it was correctly judged real but out of scope
for that PR: fixing it there would have blocked a control that is currently unmet, to protect an
isolation property no node in this cluster currently provides.