Merge pull request containerd#6372 from fidencio/wip/seutil-fix-container_kvm_t-type-detection

dmcgowan · web-flow · commit 2c9d80aba5ee · 2021-12-15T10:35:04.000-08:00
seutil: Fix setting the "container_kvm_t" label
diff --git a/pkg/cri/server/helpers_linux.go b/pkg/cri/server/helpers_linux.go
@@ -269,17 +269,10 @@ func modifyProcessLabel(runtimeType string, spec *specs.Spec) error {
 	if !isVMBasedRuntime(runtimeType) {
 		return nil
 	}
-	l, err := getKVMLabel(spec.Process.SelinuxLabel)
+	l, err := seutil.ChangeToKVM(spec.Process.SelinuxLabel)
 	if err != nil {
 		return errors.Wrap(err, "failed to get selinux kvm label")
 	}
 	spec.Process.SelinuxLabel = l
 	return nil
 }
-
-func getKVMLabel(l string) (string, error) {
-	if !seutil.HasType("container_kvm_t") {
-		return "", nil
-	}
-	return seutil.ChangeToKVM(l)
-}
diff --git a/pkg/seutil/seutil.go b/pkg/seutil/seutil.go
@@ -17,39 +17,9 @@
 package seutil
 
 import (
-	"bufio"
-	"os"
-
 	"github.com/opencontainers/selinux/go-selinux"
 )
 
-var seTypes map[string]struct{}
-
-const typePath = "/etc/selinux/targeted/contexts/customizable_types"
-
-func init() {
-	seTypes = make(map[string]struct{})
-	if !selinux.GetEnabled() {
-		return
-	}
-	f, err := os.Open(typePath)
-	if err != nil {
-		return
-	}
-	defer f.Close()
-	s := bufio.NewScanner(f)
-	for s.Scan() {
-		seTypes[s.Text()] = struct{}{}
-	}
-}
-
-// HasType returns true if the underlying system has the
-// provided selinux type enabled.
-func HasType(name string) bool {
-	_, ok := seTypes[name]
-	return ok
-}
-
 // ChangeToKVM process label
 func ChangeToKVM(l string) (string, error) {
 	if l == "" || !selinux.GetEnabled() {

Original file line number	Diff line number	Diff line change
`@@ -269,17 +269,10 @@ func modifyProcessLabel(runtimeType string, spec *specs.Spec) error {`
`269`	`269`	`if !isVMBasedRuntime(runtimeType) {`
`270`	`270`	`return nil`
`271`	`271`	`}`
`272`		`- l, err := getKVMLabel(spec.Process.SelinuxLabel)`
	`272`	`+ l, err := seutil.ChangeToKVM(spec.Process.SelinuxLabel)`
`273`	`273`	`if err != nil {`
`274`	`274`	`return errors.Wrap(err, "failed to get selinux kvm label")`
`275`	`275`	`}`
`276`	`276`	`spec.Process.SelinuxLabel = l`
`277`	`277`	`return nil`
`278`	`278`	`}`
`279`		`-`
`280`		`-func getKVMLabel(l string) (string, error) {`
`281`		`- if !seutil.HasType("container_kvm_t") {`
`282`		`- return "", nil`
`283`		`- }`
`284`		`- return seutil.ChangeToKVM(l)`
`285`		`-}`