fix: uniqMcs use all cpu

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

Author: ningmingxiao

go-selinux/label/label_linux.go

@@ -18,7 +18,10 @@ var validOptions = map[string]bool{
 	"level":    true,
 }
 
-var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be used together")
+var (
+	maxSelinuxLabelSize  = int(selinux.CategoryRange * (selinux.CategoryRange - 1) / 2)
+	ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be used together")
+)
 
 // InitLabels returns the process label and file labels to be used within
 // the container.  A list of options can be passed into this function to alter
@@ -30,6 +33,9 @@ func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
 	if !selinux.GetEnabled() {
 		return "", "", nil
 	}
+	if size := selinux.ContainerLabelsSize(); size >= maxSelinuxLabelSize {
+		return "", "", fmt.Errorf("SELinux label exhaustion: %d labels used", size)
+	}
 	processLabel, mountLabel := selinux.ContainerLabels()
 	if processLabel == "" {
 		// processLabel is required; if empty, do nothing.

go-selinux/label/label_linux_test.go

@@ -3,6 +3,7 @@ package label
 import (
 	"errors"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/opencontainers/selinux/go-selinux"
@@ -53,6 +54,22 @@ func TestInit(t *testing.T) {
 	}
 }
 
+func TestSELinuxLabelExhaustion(t *testing.T) {
+	needSELinux(t)
+	selinux.CategoryRange = 5
+	var testNull []string
+	for i := 0; i < 20; i++ {
+		_, _, err := InitLabels(testNull)
+		if i == 19 {
+			if err == nil {
+				t.Fatal("err should not be nil")
+			} else if !strings.Contains(err.Error(), "SELinux label exhaustion") {
+				t.Fatalf("unexpected error %s", err.Error())
+			}
+		}
+	}
+}
+
 func TestRelabel(t *testing.T) {
 	needSELinux(t)
 

go-selinux/selinux_linux.go

@@ -44,7 +44,7 @@ type selinuxState struct {
 	selinuxfsOnce sync.Once
 	enabledSet    bool
 	enabled       bool
-	sync.Mutex
+	sync.RWMutex
 }
 
 type level struct {
@@ -92,6 +92,12 @@ var policyRoot = sync.OnceValue(func() string {
 	return filepath.Join(selinuxDir, readConfig(selinuxTypeTag))
 })
 
+func ContainerLabelsSize() int {
+	state.RLock()
+	defer state.RUnlock()
+	return len(state.mcsList)
+}
+
 func (s *selinuxState) setEnable(enabled bool) bool {
 	s.Lock()
 	defer s.Unlock()
@@ -862,8 +868,8 @@ func checkLabel(label string) error {
 	if len(label) != 0 {
 		con := strings.SplitN(label, ":", 4)
 		if len(con) > 3 {
-			state.Lock()
-			defer state.Unlock()
+			state.RLock()
+			defer state.RUnlock()
 			if state.mcsList[con[3]] {
 				return ErrMCSAlreadyExists
 			}