sync from upstream

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

config.json.template

@@ -5,6 +5,7 @@
 	"arch": "amd64"
     },
     "process": {
+	"selinuxLabel": "system_u:system_r:container_runtime_t:s0",
 	"terminal": false,
 	"user": {
 	    "uid": 0,
@@ -283,6 +284,17 @@
 		"mode=755"
 	    ]
 	},
+	{
+	    "type": "bind",
+	    "source": "/opt",
+	    "destination": "/opt",
+	    "options": [
+		"rbind",
+		"rslave",
+		"rw",
+		"mode=755"
+	    ]
+	},
 	{
 	    "type": "bind",
 	    "source": "/mnt",
@@ -294,17 +306,6 @@
 		"mode=755"
             ]
 	},
-	{
-	    "type": "bind",
-	    "source": "/usr/share/rhel",
-	    "destination": "/usr/share/rhel",
-	    "options": [
-		"rprivate",
-		"rbind",
-		"ro",
-		"mode=755"
-	    ]
-	},
 	{
 	    "type": "bind",
 	    "source": "${RUN_DIRECTORY}",
@@ -377,10 +378,11 @@
 		"private"
 	    ]
 	}
+        $ADDTL_MOUNTS
     ],
     "hooks": {},
     "linux": {
-	"rootfsPropagation": "private",
+	"rootfsPropagation": "rslave",
 	"resources": {
 	    "devices": [
 		{
@@ -393,7 +395,6 @@
 	    {
 		"type": "mount"
 	    }
-	],
-	"selinuxProcessLabel": "system_u:system_r:container_runtime_t:s0"
+	]
     }
 }