Do you have a PoC? Even if you don't, please add the information to the security@opencontainers.org thread. I'm guessing that it would involve overwriting program code before the SELinux policy is set by runC?