selinux.go

package buildah

import (
	"errors"
	"fmt"
	"os"
	"runtime"

	"github.com/opencontainers/runtime-tools/generate"
	selinux "github.com/opencontainers/selinux/go-selinux"
)

func setupSelinux(g *generate.Generator, processLabel, mountLabel string) {
	if runtime.GOOS == "linux" && processLabel != "" && selinux.GetEnabled() {
		g.SetProcessSelinuxLabel(processLabel)
		g.SetLinuxMountLabel(mountLabel)
	}
}

func runLabelStdioPipes(stdioPipe [][]int, processLabel, mountLabel string) error {
	if runtime.GOOS != "linux" || !selinux.GetEnabled() || processLabel == "" || mountLabel == "" {
		// Not on Linux, or SELinux is disabled, or empty labels.
		return nil
	}
	pipeContext, err := selinux.ComputeCreateContext(processLabel, mountLabel, "fifo_file")
	if err != nil {
		return fmt.Errorf("computing file creation context for pipes: %w", err)
	}
	for i := range stdioPipe {
		pipeFdName := fmt.Sprintf("/proc/self/fd/%d", stdioPipe[i][0])
		if err := selinux.SetFileLabel(pipeFdName, pipeContext); err != nil && !errors.Is(err, os.ErrNotExist) {
			return fmt.Errorf("setting file label on %q: %w", pipeFdName, err)
		}
	}
	return nil
}