SELinux: fix ENOTSUP errors not being detected when relabeling

thaJeztah · thaJeztah · commit 49f8a4224cc2 · 2020-05-10T17:06:44.000+02:00
Commit 12c7541 updated the opencontainers/selinux dependency to v1.3.1, which had a breaking change in the errors that were returned. Before v1.3.1, the "raw" `syscall.ENOTSUP` was returned if the underlying filesystem did not support xattrs, but later versions wrapped the error, which caused our detection to fail. This patch uses `errors.Is()` to check for the underlying error. This requires github.com/pkg/errors v0.9.1 or above (older versions could use `errors.Cause()`, but are not compatible with "native" wrapping of errors in Go 1.13 and up, and could potentially cause these errors to not being detected again. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
diff --git a/container/container_unix.go b/container/container_unix.go
@@ -20,7 +20,6 @@ import (
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 )
 
 const (
@@ -147,7 +146,7 @@ func (container *Container) CopyImagePathContent(v volume.Volume, destination st
 			logrus.Warnf("error while unmounting volume %s: %v", v.Name(), err)
 		}
 	}()
-	if err := label.Relabel(path, container.MountLabel, true); err != nil && err != unix.ENOTSUP {
+	if err := label.Relabel(path, container.MountLabel, true); err != nil && !errors.Is(err, syscall.ENOTSUP) {
 		return err
 	}
 	return copyExistingContents(rootfs, path)
diff --git a/volume/mounts/mounts.go b/volume/mounts/mounts.go
@@ -113,7 +113,7 @@ func (m *MountPoint) Setup(mountLabel string, rootIDs idtools.Identity, checkFun
 			return
 		}
 		err = label.Relabel(sourcePath, mountLabel, label.IsShared(m.Mode))
-		if err == syscall.ENOTSUP {
+		if errors.Is(err, syscall.ENOTSUP) {
 			err = nil
 		}
 		if err != nil {

Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,6 @@ import (`
`20`	`20`	`"github.com/opencontainers/selinux/go-selinux/label"`
`21`	`21`	`"github.com/pkg/errors"`
`22`	`22`	`"github.com/sirupsen/logrus"`
`23`		`- "golang.org/x/sys/unix"`
`24`	`23`	`)`
`25`	`24`
`26`	`25`	`const (`
`@@ -147,7 +146,7 @@ func (container *Container) CopyImagePathContent(v volume.Volume, destination st`
`147`	`146`	`logrus.Warnf("error while unmounting volume %s: %v", v.Name(), err)`
`148`	`147`	`}`
`149`	`148`	`}()`
`150`		`- if err := label.Relabel(path, container.MountLabel, true); err != nil && err != unix.ENOTSUP {`
	`149`	`+ if err := label.Relabel(path, container.MountLabel, true); err != nil && !errors.Is(err, syscall.ENOTSUP) {`
`151`	`150`	`return err`
`152`	`151`	`}`
`153`	`152`	`return copyExistingContents(rootfs, path)`
Original file line number	Diff line number	Diff line change
`@@ -113,7 +113,7 @@ func (m *MountPoint) Setup(mountLabel string, rootIDs idtools.Identity, checkFun`
`113`	`113`	`return`
`114`	`114`	`}`
`115`	`115`	`err = label.Relabel(sourcePath, mountLabel, label.IsShared(m.Mode))`
`116`		`- if err == syscall.ENOTSUP {`
	`116`	`+ if errors.Is(err, syscall.ENOTSUP) {`
`117`	`117`	`err = nil`
`118`	`118`	`}`
`119`	`119`	`if err != nil {`