Restore default SELinux security contexts for containerd binaries

[hakman]

Based on #9584 which was removed together with Docker support.
Alternative to #17579.
Fixes kubernetes/kubernetes#133484.

/cc @jsafrane @ameukam

[hakman]

/hold for comments

[jsafrane]

At least on RHEL 9 with runc downloaded by kops:

Suggested change

	manifest.Set("Service", "ExecStartPre", "/bin/sh -c 'restorecon -v /usr/bin/runc'")
	manifest.Set("Service", "ExecStartPre", "/bin/sh -c 'restorecon -v /usr/sbin/runc'")

[hakman]

Good catch, updated.

[jsafrane]

/lgtm
works for me with:

kops create cluster --name=${BASE_DOMAIN} --cloud=aws --discovery-store=s3://jsafrane-kops-oidc-store/${BASE_DOMAIN}/discovery --image='309956199498/RHEL-9.6.0_HVM-20250618-x86_64-0-Hourly2-GP3' --zones=us-east-1a --ssh-public-key=/home/jsafrane/.ssh/id_rsa.pub --channel=alpha --kubernetes-feature-gates=SELinuxMount,SELinuxChangePolicy --kubernetes-version=$KUBEVERSION --set=cluster.spec.containerd.selinuxEnabled=true --set=cluster.spec.kubeControllerManager.controllers="*" --set=cluster.spec.kubeControllerManager.controllers="selinux-warning-controller" --set=cluster.spec.kubeControllerManager.logLevel=5

[hakman]

Thanks for checking @jsafrane! 🙂
/approve
/unhold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [hakman]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment