Add ChangeLabelType

All (open source) users of KVMContainerLabel[s] and InitContainerLabel[s]
(containerd, podman, and cri-o) are immediately releasing the acquired
MCS. They only need the type field, so they can change the existing
label to that type. Everything else, including the just-generated unique
MCS label, is not used.

Introduce ChangeLabelType which does just what all those users need.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Author: kolyshkin

go-selinux/selinux.go

@@ -48,6 +48,22 @@ var (
 	privContainerMountLabel string
 )
 
+// LabelType is a type to use for [ChangeLabelType]
+type LabelType int
+
+const (
+	TypeProcess LabelType = iota + 1
+	TypeInitProcess
+	TypeKVMProcess
+)
+
+// ChangeLabelType modifies the cLabel, changing its type component
+// to the one corresponding to the lType. Other cLabel components
+// are kept intact.
+func ChangeLabelType(cLabel string, lType LabelType) (string, error) {
+	return changeLabelType(cLabel, lType)
+}
+
 // Context is a representation of the SELinux label broken into 4 parts
 type Context map[string]string
 
@@ -292,6 +308,8 @@ func KVMContainerLabels() (string, string) {
 
 // KVMContainerLabel returns the default process label to be used
 // for KVM containers by the calling process.
+//
+// If you only need to change a type of existing label, use [ChangeLabelType] instead.
 func KVMContainerLabel() (string, error) {
 	return kvmContainerLabel()
 }
@@ -306,6 +324,8 @@ func InitContainerLabels() (string, string) {
 
 // InitContainerLabel returns the default process label to be used
 // for containers running an init system like systemd by the calling process.
+//
+// If you only need to change a type of existing label, use [ChangeLabelType] instead.
 func InitContainerLabel() (string, error) {
 	return initContainerLabel()
 }

go-selinux/selinux_linux.go

@@ -1513,3 +1513,46 @@ func getDefaultContextWithLevel(user, level, scon string) (string, error) {
 
 	return getDefaultContextFromReaders(&c)
 }
+
+func (kind LabelType) keys() (primary, fallback string, ok bool) {
+	switch kind {
+	case TypeProcess:
+		return "process", "", true
+	case TypeInitProcess:
+		return "init_process", "process", true
+	case TypeKVMProcess:
+		return "kvm_process", "process", true
+	}
+	return "", "", false
+}
+
+func changeLabelType(cLabel string, lt LabelType) (string, error) {
+	if cLabel == "" {
+		return "", nil
+	}
+	primary, fallback, ok := lt.keys()
+	if !ok {
+		return "", fmt.Errorf("selinux.ChangeLabelType: invalid LabelType %d", lt)
+	}
+
+	src := label(primary)
+	if src == "" && fallback != "" {
+		src = label(fallback)
+	}
+	if src == "" {
+		return cLabel, nil
+	}
+
+	// Replace cLabel type with one from src.
+	srcCtx, err := newContext(src)
+	if err != nil {
+		return "", fmt.Errorf("selinux.ChangeLabelType: invalid %s label %s: %w", primary, src, err)
+	}
+	dstCtx, err := newContext(cLabel)
+	if err != nil {
+		return "", fmt.Errorf("selinux.ChangeLabelType: invalid label %s: %w", cLabel, err)
+	}
+
+	dstCtx["type"] = srcCtx["type"]
+	return dstCtx.get(), nil
+}

go-selinux/selinux_linux_test.go

@@ -84,6 +84,69 @@ func TestSetFileLabel(t *testing.T) {
 	}
 }
 
+func TestChangeLabelType(t *testing.T) {
+	// These cases do not depend on SELinux being enabled.
+	t.Run("empty label", func(t *testing.T) {
+		out, err := ChangeLabelType("", TypeProcess)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if out != "" {
+			t.Errorf("got %q, want empty string", out)
+		}
+	})
+
+	t.Run("invalid LabelType", func(t *testing.T) {
+		if _, err := ChangeLabelType("system_u:system_r:container_t:s0", LabelType(0)); err == nil {
+			t.Error("expected error for LabelType(0), got nil")
+		}
+		if _, err := ChangeLabelType("system_u:system_r:container_t:s0", LabelType(42)); err == nil {
+			t.Error("expected error for LabelType(42), got nil")
+		}
+	})
+
+	if !GetEnabled() {
+		t.Skip("SELinux not enabled, skipping policy-dependent cases")
+	}
+
+	t.Run("invalid input label", func(t *testing.T) {
+		if _, err := ChangeLabelType("not-a-valid-label", TypeProcess); err == nil {
+			t.Error("expected error for malformed label, got nil")
+		}
+	})
+
+	t.Run("TypeKVMProcess", func(t *testing.T) {
+		// Pick a base label we can mutate. Use the process label from policy as a
+		// donor for user/role/level, but swap its type with something distinct so we
+		// can observe ChangeLabelType replacing it.
+		base := label("process")
+		if base == "" {
+			t.Skip("no process label in policy, skipping.")
+		}
+		baseCtx, err := NewContext(base)
+		if err != nil {
+			t.Fatalf("NewContext(%q): %v", base, err)
+		}
+		baseCtx["type"] = "foo_bar_baz_t"
+		if baseCtx["level"] == "" {
+			baseCtx["level"] = "s0"
+		}
+		input := baseCtx.Get()
+		res, err := ChangeLabelType(input, TypeKVMProcess)
+		t.Logf("ChangeLabelType(%q): %q", input, res)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if _, err := CanonicalizeContext(res); err != nil {
+			t.Error(err)
+		}
+		// Check the type has changed.
+		if strings.Contains(res, baseCtx["type"]) {
+			t.Errorf("want %q to not contain %q", res, baseCtx["type"])
+		}
+	})
+}
+
 func TestKVMContainerLabel(t *testing.T) {
 	if !GetEnabled() {
 		t.Skip("SELinux not enabled, skipping.")

go-selinux/selinux_stub.go

@@ -157,3 +157,7 @@ func getDefaultContextWithLevel(string, string, string) (string, error) {
 func label(_ string) string {
 	return ""
 }
+
+func changeLabelType(string, LabelType) (string, error) {
+	return "", nil
+}

go-selinux/selinux_stub_test.go

@@ -120,4 +120,7 @@ func TestSELinuxStubs(t *testing.T) {
 	if _, err = CopyLevel("foo", "bar"); err != nil {
 		t.Error(err)
 	}
+	if _, err = ChangeLabelType("", TypeProcess); err != nil {
+		t.Error(err)
+	}
 }