Could you please investigate a new SELinux mount failure on our Rocky Linux systems? We are seeing denials when mounting an ISO with a specific context

[abhishek_08]

Observations:

The system is trying to mount a filesystem (in this case, an iso9660 image mounted on loop2), but SELinux is blocking it because the same underlying filesystem (same superblock) is being mounted twice or more with differing security contexts or settings. SELinux enforces strict labeling rules, and this inconsistency triggers a denial.

• Why it’s a violation?
  SELinux ensures that every mounted filesystem is accessed according to its defined policies. When the same device is mounted with conflicting labels or permissions, it could lead to privilege escalation or data integrity issues. So SELinux treats this as a violation and blocks the operation.

Command which is used and this caused a failure:

sudo mount -o ro,context=\“system_u:object_r:container_file_t:s0\” /xxxxx/XXos-25.12.0-3.iso /xxxx/xxx/

But when I tried manually to mount the ISO with this command it works without any errors ,

sudo mount -o ro /xxxxx/xxxxx-25.12.0-3.iso /xxxxx/xxxxx/
Logs which can be found out /var/log/messages, below image shows details about selinux mount failure

why does mounting cause this issue ?

[iwalker]

You can use the console tools like:

audit2why -a

and:

audit2allow -a

which will give information on why it didn’t work. They will also give answers on what to do to resolve it.

[abhishek_08]

okay @iwalker will try them