Merge pull request #254 from kolyshkin/cut

Use Cut more

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

Author: rhatdan

go-selinux/label/label_linux.go

@@ -17,6 +17,7 @@ var validOptions = map[string]bool{
 	"role":     true,
 	"level":    true,
 }
+var maxSelinuxLabelSize = int(selinux.CategoryRange * (selinux.CategoryRange - 1) / 2)
 
 var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be used together")
 
@@ -30,52 +31,54 @@ func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
 	if !selinux.GetEnabled() {
 		return "", "", nil
 	}
+	if size := selinux.ContainerLabelsSize(); size >= maxSelinuxLabelSize {
+		return "", "", fmt.Errorf("SELinux label exhaustion: %d labels used", size)
+	}
 	processLabel, mountLabel := selinux.ContainerLabels()
-	if processLabel != "" {
-		defer func() {
-			if retErr != nil {
-				selinux.ReleaseLabel(mountLabel)
-			}
-		}()
-		pcon, err := selinux.NewContext(processLabel)
-		if err != nil {
-			return "", "", err
+	if processLabel == "" {
+		// processLabel is required; if empty, do nothing.
+		return processLabel, mountLabel, nil
+	}
+	defer func() {
+		if retErr != nil {
+			selinux.ReleaseLabel(mountLabel)
 		}
-		mcsLevel := pcon["level"]
-		mcon, err := selinux.NewContext(mountLabel)
-		if err != nil {
-			return "", "", err
+	}()
+	pcon, err := selinux.NewContext(processLabel)
+	if err != nil {
+		return "", "", err
+	}
+	mcsLevel := pcon["level"]
+	mcon, err := selinux.NewContext(mountLabel)
+	if err != nil {
+		return "", "", err
+	}
+	for _, opt := range options {
+		if opt == "disable" {
+			selinux.ReleaseLabel(mountLabel)
+			return "", selinux.PrivContainerMountLabel(), nil
+		}
+		k, v, ok := strings.Cut(opt, ":")
+		if !ok || !validOptions[k] {
+			return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
 		}
-		for _, opt := range options {
-			if opt == "disable" {
-				selinux.ReleaseLabel(mountLabel)
-				return "", selinux.PrivContainerMountLabel(), nil
-			}
-			if !strings.Contains(opt, ":") {
-				return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
-			}
-			con := strings.SplitN(opt, ":", 2)
-			if !validOptions[con[0]] {
-				return "", "", fmt.Errorf("bad label option %q, valid options 'disable, user, role, level, type, filetype'", con[0])
-			}
-			if con[0] == "filetype" {
-				mcon["type"] = con[1]
-				continue
-			}
-			pcon[con[0]] = con[1]
-			if con[0] == "level" || con[0] == "user" {
-				mcon[con[0]] = con[1]
-			}
+		if k == "filetype" {
+			mcon["type"] = v
+			continue
 		}
-		if pcon.Get() != processLabel {
-			if pcon["level"] != mcsLevel {
-				selinux.ReleaseLabel(processLabel)
-			}
-			processLabel = pcon.Get()
-			selinux.ReserveLabel(processLabel)
+		pcon[k] = v
+		if k == "level" || k == "user" {
+			mcon[k] = v
+		}
+	}
+	if p := pcon.Get(); p != processLabel {
+		if pcon["level"] != mcsLevel {
+			selinux.ReleaseLabel(processLabel)
 		}
-		mountLabel = mcon.Get()
+		selinux.ReserveLabel(p)
+		processLabel = p
 	}
+	mountLabel = mcon.Get()
 	return processLabel, mountLabel, nil
 }
 

go-selinux/label/label_linux_test.go

@@ -3,6 +3,7 @@ package label
 import (
 	"errors"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/opencontainers/selinux/go-selinux"
@@ -53,6 +54,22 @@ func TestInit(t *testing.T) {
 	}
 }
 
+func TestSELinuxLabelExhaustion(t *testing.T) {
+	needSELinux(t)
+	selinux.CategoryRange = 5
+	var testNull []string
+	for i := 0; i < 20; i++ {
+		_, _, err := InitLabels(testNull)
+		if i == 19 {
+			if err == nil {
+				t.Fatal("err should not be nil")
+			} else if !strings.Contains(err.Error(), "SELinux label exhaustion") {
+				t.Fatalf("unexpected error %s", err.Error())
+			}
+		}
+	}
+}
+
 func TestRelabel(t *testing.T) {
 	needSELinux(t)
 

go-selinux/selinux_linux.go

@@ -44,7 +44,7 @@ type selinuxState struct {
 	selinuxfsOnce sync.Once
 	enabledSet    bool
 	enabled       bool
-	sync.Mutex
+	sync.RWMutex
 }
 
 type level struct {
@@ -92,6 +92,12 @@ var policyRoot = sync.OnceValue(func() string {
 	return filepath.Join(selinuxDir, readConfig(selinuxTypeTag))
 })
 
+func ContainerLabelsSize() int {
+	state.RLock()
+	defer state.RUnlock()
+	return len(state.mcsList)
+}
+
 func (s *selinuxState) setEnable(enabled bool) bool {
 	s.Lock()
 	defer s.Unlock()
@@ -243,12 +249,9 @@ func readConfig(target string) string {
 			// Skip comments
 			continue
 		}
-		fields := bytes.SplitN(line, []byte{'='}, 2)
-		if len(fields) != 2 {
-			continue
-		}
-		if bytes.Equal(fields[0], []byte(target)) {
-			return string(bytes.Trim(fields[1], `"`))
+		key, val, ok := bytes.Cut(line, []byte{'='})
+		if ok && string(key) == target {
+			return string(bytes.Trim(val, `"`))
 		}
 	}
 	return ""
@@ -580,21 +583,20 @@ func catsToBitset(cats string) (*big.Int, error) {
 
 	catlist := strings.Split(cats, ",")
 	for _, r := range catlist {
-		ranges := strings.SplitN(r, ".", 2)
-		if len(ranges) > 1 {
-			catstart, err := parseLevelItem(ranges[0], category)
+		if s, e, ok := strings.Cut(r, "."); ok {
+			catstart, err := parseLevelItem(s, category)
 			if err != nil {
 				return nil, err
 			}
-			catend, err := parseLevelItem(ranges[1], category)
+			catend, err := parseLevelItem(e, category)
 			if err != nil {
 				return nil, err
 			}
 			for i := catstart; i <= catend; i++ {
 				bitset.SetBit(bitset, i, 1)
 			}
 		} else {
-			cat, err := parseLevelItem(ranges[0], category)
+			cat, err := parseLevelItem(r, category)
 			if err != nil {
 				return nil, err
 			}
@@ -622,14 +624,14 @@ func parseLevelItem(s string, sep levelItem) (int, error) {
 // parseLevel fills a level from a string that contains
 // a sensitivity and categories
 func (l *level) parseLevel(levelStr string) error {
-	lvl := strings.SplitN(levelStr, ":", 2)
-	sens, err := parseLevelItem(lvl[0], sensitivity)
+	s, c, ok := strings.Cut(levelStr, ":")
+	sens, err := parseLevelItem(s, sensitivity)
 	if err != nil {
 		return fmt.Errorf("failed to parse sensitivity: %w", err)
 	}
 	l.sens = sens
-	if len(lvl) > 1 {
-		cats, err := catsToBitset(lvl[1])
+	if ok {
+		cats, err := catsToBitset(c)
 		if err != nil {
 			return fmt.Errorf("failed to parse categories: %w", err)
 		}
@@ -642,25 +644,19 @@ func (l *level) parseLevel(levelStr string) error {
 // rangeStrToMLSRange marshals a string representation of a range.
 func rangeStrToMLSRange(rangeStr string) (*mlsRange, error) {
 	r := &mlsRange{}
-	l := strings.SplitN(rangeStr, "-", 2)
-
-	switch len(l) {
-	// rangeStr that has a low and a high level, e.g. s4:c0.c1023-s6:c0.c1023
-	case 2:
+	lo, hi, ok := strings.Cut(rangeStr, "-")
+	r.low = &level{}
+	if err := r.low.parseLevel(lo); err != nil {
+		return nil, fmt.Errorf("failed to parse low level %q: %w", lo, err)
+	}
+	if ok {
+		// rangeStr that has a low and a high level, e.g. s4:c0.c1023-s6:c0.c1023.
 		r.high = &level{}
-		if err := r.high.parseLevel(l[1]); err != nil {
-			return nil, fmt.Errorf("failed to parse high level %q: %w", l[1], err)
+		if err := r.high.parseLevel(hi); err != nil {
+			return nil, fmt.Errorf("failed to parse high level %q: %w", hi, err)
 		}
-		fallthrough
-	// rangeStr that is single level, e.g. s6:c0,c3,c5,c30.c1023
-	case 1:
-		r.low = &level{}
-		if err := r.low.parseLevel(l[0]); err != nil {
-			return nil, fmt.Errorf("failed to parse low level %q: %w", l[0], err)
-		}
-	}
-
-	if r.high == nil {
+	} else {
+		// rangeStr that is single level, e.g. s6:c0,c3,c5,c30.c1023.
 		r.high = r.low
 	}
 
@@ -872,8 +868,8 @@ func checkLabel(label string) error {
 	if len(label) != 0 {
 		con := strings.SplitN(label, ":", 4)
 		if len(con) > 3 {
-			state.Lock()
-			defer state.Unlock()
+			state.RLock()
+			defer state.RUnlock()
 			if state.mcsList[con[3]] {
 				return ErrMCSAlreadyExists
 			}
@@ -1020,12 +1016,10 @@ var loadLabels = sync.OnceValue(func() map[string]string {
 			// Skip comments
 			continue
 		}
-		fields := bytes.SplitN(line, []byte{'='}, 2)
-		if len(fields) != 2 {
-			continue
+		if key, val, ok := bytes.Cut(line, []byte{'='}); ok {
+			key, val = bytes.TrimSpace(key), bytes.TrimSpace(val)
+			labels[string(key)] = string(bytes.Trim(val, `"`))
 		}
-		key, val := bytes.TrimSpace(fields[0]), bytes.TrimSpace(fields[1])
-		labels[string(key)] = string(bytes.Trim(val, `"`))
 	}
 
 	con, _ := NewContext(labels["file"])

go-selinux/selinux_linux_test.go

@@ -131,32 +131,27 @@ func TestDuplicateLabel(t *testing.T) {
 		t.Fatalf("DupSecOpt: %v", err)
 	}
 	for _, opt := range secopt {
-		con := strings.SplitN(opt, ":", 2)
-		if con[0] == "user" {
-			if con[1] != "system_u" {
+		key, val, _ := strings.Cut(opt, ":")
+		switch key {
+		case "user":
+			if val != "system_u" {
 				t.Errorf("DupSecOpt Failed user incorrect")
 			}
-			continue
-		}
-		if con[0] == "role" {
-			if con[1] != "system_r" {
+		case "role":
+			if val != "system_r" {
 				t.Errorf("DupSecOpt Failed role incorrect")
 			}
-			continue
-		}
-		if con[0] == "type" {
-			if con[1] != "container_t" {
+		case "type":
+			if val != "container_t" {
 				t.Errorf("DupSecOpt Failed type incorrect")
 			}
-			continue
-		}
-		if con[0] == "level" {
-			if con[1] != "s0:c1,c2" {
+		case "level":
+			if val != "s0:c1,c2" {
 				t.Errorf("DupSecOpt Failed level incorrect")
 			}
-			continue
+		default:
+			t.Errorf("DupSecOpt failed: invalid field %q", key)
 		}
-		t.Errorf("DupSecOpt failed: invalid field %q", con[0])
 	}
 	secopt = DisableSecOpt()
 	if secopt[0] != "disable" {