Add relabel option to secrets

newsfragments/secret-selinux-relabel-option.feature

@@ -0,0 +1 @@
+- Add relabel option to secret to make possible to read the secret file by the contained process.

podman_compose.py

@@ -583,6 +583,7 @@ def get_secret_args(compose, cnt, secret, podman_is_building=False):
     declared_secret = compose.declared_secrets[secret_name]
 
     source_file = declared_secret.get("file")
+    secret_relabel = declared_secret.get("relabel")
     dest_file = ""
     secret_opts = ""
 
@@ -624,7 +625,15 @@ def get_secret_args(compose, cnt, secret, podman_is_building=False):
                 dest_file = f"/run/secrets/{sec}"
             else:
                 dest_file = secret_target
-            volume_ref = ["--volume", f"{source_file}:{dest_file}:ro,rprivate,rbind"]
+
+            mount_options = 'ro,rprivate,rbind'
+            if secret_relabel not in set(("z", "Z", None)):
+                raise ValueError(
+                    f'ERORR: Run secret "{secret_name} has invalid "relabel" option '
+                    + f'"{secret_relabel}". Expected "Z" "z" or nothing.')
+            if secret_relabel:
+                mount_options = f'{mount_options},{secret_relabel}'
+            volume_ref = ["--volume", f"{source_file}:{dest_file}:{mount_options}"]
 
         if secret_uid or secret_gid or secret_mode:
             sec = secret_target if secret_target else secret_name

tests/unit/test_container_to_args_secrets.py

@@ -302,6 +302,17 @@ async def test_secret_target_matches_secret_name_secret_type_not_env(self):
             "file_secret",
             repo_root() + "/test_dirname/my_secret:/run/secrets/file_secret:ro,rprivate,rbind",
         ),
+        (
+            "relabel",
+            {
+                "file_secret": {
+                    "file": "./my_secret",
+                    "relabel": "Z"
+                }
+            },
+            "file_secret",
+            repo_root() + "/test_dirname/my_secret:/run/secrets/file_secret:ro,rprivate,rbind,Z",
+        ),
         (
             "custom_target_name",
             {