Just a heads-up for the newer Fedora Atomic users out there, and a focus on this part for the longer-term users:
This only impacts new installations and not updated systems thus systems installed from artifacts before those releases are not impacted (Fedora 38 or earlier).
Isn’t selinux enabled by default? Hence, most won’t be affected.
On systems with SELinux enabled and in enforcing mode, access to those files is limited to unconfined (usually interactive) users, unconfined systemd services and privileged containers. Confined daemons, users and containers are not able to access them.
I’m not sure you’re right, I can’t find information regarding whether users are confined by default on Fedora (Red Hat docs seem to indicate the users are unconfined by default).
Edit: They are not, see https://docs.fedoraproject.org/en-US/quick-docs/selinux-getting-started/#_selinux_examples, specifically:
SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as sudo and su, as well as preventing them from executing files and applications in their home directory. If configured, this prevents users from executing malicious files from their home directories.
ls -Z in any user home will show they are unconfined_u (so will id -Z).
