fix: uniqMcs use all cpu

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

Author: ningmingxiao

go-selinux/label/label_linux.go

@@ -2,22 +2,11 @@ package label
 
 import (
 	"errors"
-	"fmt"
 	"strings"
 
 	"github.com/opencontainers/selinux/go-selinux"
 )
 
-// Valid Label Options
-var validOptions = map[string]bool{
-	"disable":  true,
-	"type":     true,
-	"filetype": true,
-	"user":     true,
-	"role":     true,
-	"level":    true,
-}
-
 var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be used together")
 
 // InitLabels returns the process label and file labels to be used within
@@ -27,55 +16,7 @@ var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be us
 // If the disabled flag is passed in, the process label will not be set, but the mount label will be set
 // to the container_file label with the maximum category. This label is not usable by any confined label.
 func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
-	if !selinux.GetEnabled() {
-		return "", "", nil
-	}
-	processLabel, mountLabel := selinux.ContainerLabels()
-	if processLabel == "" {
-		// processLabel is required; if empty, do nothing.
-		return processLabel, mountLabel, nil
-	}
-	defer func() {
-		if retErr != nil {
-			selinux.ReleaseLabel(mountLabel)
-		}
-	}()
-	pcon, err := selinux.NewContext(processLabel)
-	if err != nil {
-		return "", "", err
-	}
-	mcsLevel := pcon["level"]
-	mcon, err := selinux.NewContext(mountLabel)
-	if err != nil {
-		return "", "", err
-	}
-	for _, opt := range options {
-		if opt == "disable" {
-			selinux.ReleaseLabel(mountLabel)
-			return "", selinux.PrivContainerMountLabel(), nil
-		}
-		k, v, ok := strings.Cut(opt, ":")
-		if !ok || !validOptions[k] {
-			return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
-		}
-		if k == "filetype" {
-			mcon["type"] = v
-			continue
-		}
-		pcon[k] = v
-		if k == "level" || k == "user" {
-			mcon[k] = v
-		}
-	}
-	if p := pcon.Get(); p != processLabel {
-		if pcon["level"] != mcsLevel {
-			selinux.ReleaseLabel(processLabel)
-		}
-		selinux.ReserveLabel(p)
-		processLabel = p
-	}
-	mountLabel = mcon.Get()
-	return processLabel, mountLabel, nil
+	return selinux.InitLabels(options)
 }
 
 // SetFileLabel modifies the "path" label to the specified file label

go-selinux/label/label_linux_test.go

@@ -3,6 +3,7 @@ package label
 import (
 	"errors"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/opencontainers/selinux/go-selinux"
@@ -53,6 +54,22 @@ func TestInit(t *testing.T) {
 	}
 }
 
+func TestSELinuxLabelExhaustion(t *testing.T) {
+	needSELinux(t)
+	selinux.CategoryRange = 5
+	var testNull []string
+	for i := 0; i < 20; i++ {
+		_, _, err := InitLabels(testNull)
+		if i == 19 {
+			if err == nil {
+				t.Fatal("err should not be nil")
+			} else if !strings.Contains(err.Error(), "SELinux label exhaustion") {
+				t.Fatalf("unexpected error %s", err.Error())
+			}
+		}
+	}
+}
+
 func TestRelabel(t *testing.T) {
 	needSELinux(t)
 

go-selinux/labels.go

@@ -0,0 +1,77 @@
+package selinux
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Valid Label Options
+var validOptions = map[string]bool{
+	"disable":  true,
+	"type":     true,
+	"filetype": true,
+	"user":     true,
+	"role":     true,
+	"level":    true,
+}
+
+// InitLabels returns the process label and file labels to be used within
+// the container.  A list of options can be passed into this function to alter
+// the labels.  The labels returned will include a random MCS String, that is
+// guaranteed to be unique.
+// If the disabled flag is passed in, the process label will not be set, but the mount label will be set
+// to the container_file label with the maximum category. This label is not usable by any confined label.
+func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
+	if !GetEnabled() {
+		return "", "", nil
+	}
+	if err := checkSELinuxLabelExhaustion(); err != nil {
+		return "", "", err
+	}
+	processLabel, mountLabel := containerLabels()
+	if processLabel == "" {
+		// processLabel is required; if empty, do nothing.
+		return processLabel, mountLabel, nil
+	}
+	defer func() {
+		if retErr != nil {
+			ReleaseLabel(mountLabel)
+		}
+	}()
+	pcon, err := NewContext(processLabel)
+	if err != nil {
+		return "", "", err
+	}
+	mcsLevel := pcon["level"]
+	mcon, err := NewContext(mountLabel)
+	if err != nil {
+		return "", "", err
+	}
+	for _, opt := range options {
+		if opt == "disable" {
+			ReleaseLabel(mountLabel)
+			return "", PrivContainerMountLabel(), nil
+		}
+		k, v, ok := strings.Cut(opt, ":")
+		if !ok || !validOptions[k] {
+			return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
+		}
+		if k == "filetype" {
+			mcon["type"] = v
+			continue
+		}
+		pcon[k] = v
+		if k == "level" || k == "user" {
+			mcon[k] = v
+		}
+	}
+	if p := pcon.Get(); p != processLabel {
+		if pcon["level"] != mcsLevel {
+			ReleaseLabel(processLabel)
+		}
+		ReserveLabel(p)
+		processLabel = p
+	}
+	mountLabel = mcon.Get()
+	return processLabel, mountLabel, nil
+}

go-selinux/selinux.go

@@ -262,20 +262,38 @@ func ROFileLabel() string {
 
 // KVMContainerLabels returns the default processLabel and mountLabel to be used
 // for kvm containers by the calling process.
+//
+// Deprecated: Use KVMContainerLabel instead.
 func KVMContainerLabels() (string, string) {
 	return kvmContainerLabels()
 }
 
+// KVMContainerLabel returns the default processLabel and mountLabel to be used
+// for kvm containers by the calling process.
+func KVMContainerLabel() (processLabel, fileLabel string, err error) {
+	if err = checkSELinuxLabelExhaustion(); err != nil {
+		return "", "", err
+	}
+	processLabel, fileLabel = kvmContainerLabels()
+	return processLabel, fileLabel, nil
+}
+
 // InitContainerLabels returns the default processLabel and file labels to be
 // used for containers running an init system like systemd by the calling process.
+//
+// Deprecated: Use InitContainerLabel instead.
 func InitContainerLabels() (string, string) {
 	return initContainerLabels()
 }
 
-// ContainerLabels returns an allocated processLabel and fileLabel to be used for
-// container labeling by the calling process.
-func ContainerLabels() (processLabel string, fileLabel string) {
-	return containerLabels()
+// InitContainerLabel returns the default processLabel and file labels to be
+// used for containers running an init system like systemd by the calling process.
+func InitContainerLabel() (processLabel, fileLabel string, err error) {
+	if err = checkSELinuxLabelExhaustion(); err != nil {
+		return "", "", err
+	}
+	processLabel, fileLabel = initContainerLabels()
+	return processLabel, fileLabel, nil
 }
 
 // SecurityCheckContext validates that the SELinux label is understood by the kernel

go-selinux/selinux_linux.go

@@ -38,11 +38,13 @@ const (
 	xattrNameSelinux = "security.selinux"
 )
 
+var maxSelinuxLabelSize = int(CategoryRange * (CategoryRange - 1) / 2)
+
 type selinuxState struct {
 	mcsList    map[string]bool
 	enabledSet bool
 	enabled    bool
-	sync.Mutex
+	sync.RWMutex
 }
 
 type level struct {
@@ -90,6 +92,12 @@ var policyRoot = sync.OnceValue(func() string {
 	return filepath.Join(selinuxDir, readConfig(selinuxTypeTag))
 })
 
+func containerLabelsSize() int {
+	state.RLock()
+	defer state.RUnlock()
+	return len(state.mcsList)
+}
+
 func (s *selinuxState) setEnable(enabled bool) bool {
 	s.Lock()
 	defer s.Unlock()
@@ -848,8 +856,8 @@ func checkLabel(label string) error {
 	if len(label) != 0 {
 		con := strings.SplitN(label, ":", 4)
 		if len(con) > 3 {
-			state.Lock()
-			defer state.Unlock()
+			state.RLock()
+			defer state.RUnlock()
 			if state.mcsList[con[3]] {
 				return ErrMCSAlreadyExists
 			}
@@ -1035,6 +1043,13 @@ func initContainerLabels() (string, string) {
 	return addMcs(processLabel, label("file"))
 }
 
+func checkSELinuxLabelExhaustion() error {
+	if size := containerLabelsSize(); size >= maxSelinuxLabelSize {
+		return fmt.Errorf("SELinux label exhaustion: %d labels used", size)
+	}
+	return nil
+}
+
 // containerLabels returns an allocated processLabel and fileLabel to be used for
 // container labeling by the calling process.
 func containerLabels() (processLabel string, fileLabel string) {

go-selinux/selinux_linux_test.go

@@ -110,7 +110,10 @@ func TestInitLabels(t *testing.T) {
 		t.Skip("SELinux not enabled, skipping.")
 	}
 
-	plabel, flabel := InitContainerLabels()
+	plabel, flabel, err := InitContainerLabel()
+	if err != nil {
+		t.Fatal(err)
+	}
 	if plabel == "" {
 		t.Log("Failed to read init label")
 	}
@@ -291,20 +294,32 @@ func TestSELinux(t *testing.T) {
 		plabel, flabel string
 	)
 
-	plabel, flabel = ContainerLabels()
+	plabel, flabel, err = InitLabels([]string{})
+	if err != nil {
+		t.Fatal("InitLabels failed:", err)
+	}
 	t.Log(plabel)
 	t.Log(flabel)
-	plabel, flabel = ContainerLabels()
+	plabel, flabel, err = InitLabels([]string{})
+	if err != nil {
+		t.Fatal("InitLabels failed:", err)
+	}
 	t.Log(plabel)
 	t.Log(flabel)
 	ReleaseLabel(plabel)
 
-	plabel, flabel = ContainerLabels()
+	plabel, flabel, err = InitLabels([]string{})
+	if err != nil {
+		t.Fatal("InitLabels failed:", err)
+	}
 	t.Log(plabel)
 	t.Log(flabel)
 	ClearLabels()
 	t.Log("ClearLabels")
-	plabel, flabel = ContainerLabels()
+	plabel, flabel, err = InitLabels([]string{})
+	if err != nil {
+		t.Fatal("InitLabels failed:", err)
+	}
 	t.Log(plabel)
 	t.Log(flabel)
 	ReleaseLabel(plabel)

go-selinux/selinux_stub.go

@@ -134,6 +134,10 @@ func containerLabels() (string, string) {
 	return "", ""
 }
 
+func checkSELinuxLabelExhaustion() error {
+	return nil
+}
+
 func securityCheckContext(string) error {
 	return nil
 }

go-selinux/selinux_stub_test.go

@@ -115,7 +115,7 @@ func TestSELinuxStubs(t *testing.T) {
 	if v := ROFileLabel(); v != "" {
 		t.Errorf(`expected "", got %q`, v)
 	}
-	if processLbl, fileLbl := ContainerLabels(); processLbl != "" || fileLbl != "" {
+	if processLbl, fileLbl, err := InitLabels([]string{}); err == nil && (processLbl != "" || fileLbl != "") {
 		t.Errorf(`expected fileLbl="", fileLbl="" got processLbl=%q, fileLbl=%q`, processLbl, fileLbl)
 	}
 	if err = SecurityCheckContext(testLabel); err != nil {