fix: uniqMcs use all cpu

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

Author: ningmingxiao

go-selinux/label/label_linux.go

@@ -2,22 +2,11 @@ package label
 
 import (
 	"errors"
-	"fmt"
 	"strings"
 
 	"github.com/opencontainers/selinux/go-selinux"
 )
 
-// Valid Label Options
-var validOptions = map[string]bool{
-	"disable":  true,
-	"type":     true,
-	"filetype": true,
-	"user":     true,
-	"role":     true,
-	"level":    true,
-}
-
 var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be used together")
 
 // InitLabels returns the process label and file labels to be used within
@@ -27,55 +16,7 @@ var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be us
 // If the disabled flag is passed in, the process label will not be set, but the mount label will be set
 // to the container_file label with the maximum category. This label is not usable by any confined label.
 func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
-	if !selinux.GetEnabled() {
-		return "", "", nil
-	}
-	processLabel, mountLabel := selinux.ContainerLabels()
-	if processLabel == "" {
-		// processLabel is required; if empty, do nothing.
-		return processLabel, mountLabel, nil
-	}
-	defer func() {
-		if retErr != nil {
-			selinux.ReleaseLabel(mountLabel)
-		}
-	}()
-	pcon, err := selinux.NewContext(processLabel)
-	if err != nil {
-		return "", "", err
-	}
-	mcsLevel := pcon["level"]
-	mcon, err := selinux.NewContext(mountLabel)
-	if err != nil {
-		return "", "", err
-	}
-	for _, opt := range options {
-		if opt == "disable" {
-			selinux.ReleaseLabel(mountLabel)
-			return "", selinux.PrivContainerMountLabel(), nil
-		}
-		k, v, ok := strings.Cut(opt, ":")
-		if !ok || !validOptions[k] {
-			return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
-		}
-		if k == "filetype" {
-			mcon["type"] = v
-			continue
-		}
-		pcon[k] = v
-		if k == "level" || k == "user" {
-			mcon[k] = v
-		}
-	}
-	if p := pcon.Get(); p != processLabel {
-		if pcon["level"] != mcsLevel {
-			selinux.ReleaseLabel(processLabel)
-		}
-		selinux.ReserveLabel(p)
-		processLabel = p
-	}
-	mountLabel = mcon.Get()
-	return processLabel, mountLabel, nil
+	return selinux.InitLabels(options)
 }
 
 // SetFileLabel modifies the "path" label to the specified file label

go-selinux/label/label_linux_test.go

@@ -3,6 +3,7 @@ package label
 import (
 	"errors"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/opencontainers/selinux/go-selinux"
@@ -53,6 +54,22 @@ func TestInit(t *testing.T) {
 	}
 }
 
+func TestSELinuxLabelExhaustion(t *testing.T) {
+	needSELinux(t)
+	selinux.CategoryRange = 5
+	var testNull []string
+	for i := 0; i < 20; i++ {
+		_, _, err := InitLabels(testNull)
+		if i == 19 {
+			if err == nil {
+				t.Fatal("err should not be nil")
+			} else if !strings.Contains(err.Error(), "SELinux label exhaustion") {
+				t.Fatalf("unexpected error %s", err.Error())
+			}
+		}
+	}
+}
+
 func TestRelabel(t *testing.T) {
 	needSELinux(t)
 

go-selinux/labels.go

@@ -0,0 +1,77 @@
+package selinux
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Valid Label Options
+var validOptions = map[string]bool{
+	"disable":  true,
+	"type":     true,
+	"filetype": true,
+	"user":     true,
+	"role":     true,
+	"level":    true,
+}
+
+// InitLabels returns the process label and file labels to be used within
+// the container.  A list of options can be passed into this function to alter
+// the labels.  The labels returned will include a random MCS String, that is
+// guaranteed to be unique.
+// If the disabled flag is passed in, the process label will not be set, but the mount label will be set
+// to the container_file label with the maximum category. This label is not usable by any confined label.
+func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
+	if !GetEnabled() {
+		return "", "", nil
+	}
+	processLabel, mountLabel, err := containerLabels()
+	if err != nil {
+		return "", "", err
+	}
+	if processLabel == "" {
+		// processLabel is required; if empty, do nothing.
+		return processLabel, mountLabel, nil
+	}
+	defer func() {
+		if retErr != nil {
+			ReleaseLabel(mountLabel)
+		}
+	}()
+	pcon, err := NewContext(processLabel)
+	if err != nil {
+		return "", "", err
+	}
+	mcsLevel := pcon["level"]
+	mcon, err := NewContext(mountLabel)
+	if err != nil {
+		return "", "", err
+	}
+	for _, opt := range options {
+		if opt == "disable" {
+			ReleaseLabel(mountLabel)
+			return "", PrivContainerMountLabel(), nil
+		}
+		k, v, ok := strings.Cut(opt, ":")
+		if !ok || !validOptions[k] {
+			return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
+		}
+		if k == "filetype" {
+			mcon["type"] = v
+			continue
+		}
+		pcon[k] = v
+		if k == "level" || k == "user" {
+			mcon[k] = v
+		}
+	}
+	if p := pcon.Get(); p != processLabel {
+		if pcon["level"] != mcsLevel {
+			ReleaseLabel(processLabel)
+		}
+		ReserveLabel(p)
+		processLabel = p
+	}
+	mountLabel = mcon.Get()
+	return processLabel, mountLabel, nil
+}

go-selinux/selinux.go

@@ -20,6 +20,7 @@ const (
 var (
 	// ErrMCSAlreadyExists is returned when trying to allocate a duplicate MCS.
 	ErrMCSAlreadyExists = errors.New("MCS label already exists")
+	ErrMCSExhausted     = errors.New("MCS label exhausted")
 	// ErrEmptyPath is returned when an empty path has been specified.
 	ErrEmptyPath = errors.New("empty path")
 
@@ -217,8 +218,15 @@ func ClearLabels() {
 }
 
 // ReserveLabel reserves the MLS/MCS level component of the specified label
+//
+// Deprecated: Use ReserveLabelV2 instead.
 func ReserveLabel(label string) {
-	reserveLabel(label)
+	_ = reserveLabel(label)
+}
+
+// ReserveLabelV2 reserves the MLS/MCS level component of the specified label
+func ReserveLabelV2(label string) error {
+	return reserveLabel(label)
 }
 
 // CheckLabel check the MLS/MCS level component of the specified label
@@ -262,20 +270,32 @@ func ROFileLabel() string {
 
 // KVMContainerLabels returns the default processLabel and mountLabel to be used
 // for kvm containers by the calling process.
+//
+// Deprecated: Use KVMContainerLabelsV2 instead.
 func KVMContainerLabels() (string, string) {
+	processLabel, fileLabel, _ := kvmContainerLabels()
+	return processLabel, fileLabel
+}
+
+// KVMContainerLabelsV2 returns the default processLabel and mountLabel to be used
+// for kvm containers by the calling process.
+func KVMContainerLabelsV2() (processLabel, fileLabel string, err error) {
 	return kvmContainerLabels()
 }
 
 // InitContainerLabels returns the default processLabel and file labels to be
 // used for containers running an init system like systemd by the calling process.
+//
+// Deprecated: Use InitContainerLabelsV2 instead.
 func InitContainerLabels() (string, string) {
-	return initContainerLabels()
+	processLabel, fileLabel, _ := initContainerLabels()
+	return processLabel, fileLabel
 }
 
-// ContainerLabels returns an allocated processLabel and fileLabel to be used for
-// container labeling by the calling process.
-func ContainerLabels() (processLabel string, fileLabel string) {
-	return containerLabels()
+// InitContainerLabelsV2 returns the default processLabel and file labels to be
+// used for containers running an init system like systemd by the calling process.
+func InitContainerLabelsV2() (processLabel, fileLabel string, err error) {
+	return initContainerLabels()
 }
 
 // SecurityCheckContext validates that the SELinux label is understood by the kernel
@@ -330,6 +350,6 @@ func GetDefaultContextWithLevel(user, level, scon string) (string, error) {
 // PrivContainerMountLabel returns mount label for privileged containers
 func PrivContainerMountLabel() string {
 	// Make sure label is initialized.
-	_ = label("")
+	_, _ = label("")
 	return privContainerMountLabel
 }