[DO NOT MERGE] move selinux implementation to internal package

.codespellrc

@@ -1,2 +1,2 @@
 [codespell]
-skip = ./.git,./go.sum,./go-selinux/testdata
+skip = ./.git,./go.sum,,./internal/impl/testdata

.github/workflows/validate.yml

@@ -147,7 +147,7 @@ jobs:
       # https://github.com/opencontainers/selinux/issues/225
       - name: "racy test"
         continue-on-error: true
-        run: lima bash -c 'cd /tmp/selinux && go test -timeout 10m -count 100000 ./go-selinux'
+        run: lima bash -c 'cd /tmp/selinux && go test -timeout 10m -count 100000 ./internal/impl'
 
       - name: "Show AVC denials"
         run: lima sudo ausearch -m AVC,USER_AVC || true

go-selinux/label/label.go

@@ -3,12 +3,12 @@ package label
 import (
 	"fmt"
 
-	"github.com/opencontainers/selinux/go-selinux"
+	"github.com/opencontainers/selinux/internal/impl"
 )
 
 // Init initialises the labeling system
 func Init() {
-	_ = selinux.GetEnabled()
+	_ = impl.GetEnabled()
 }
 
 // FormatMountLabel returns a string to be used by the mount command. Using

go-selinux/label/label_linux.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/opencontainers/selinux/go-selinux"
+	"github.com/opencontainers/selinux/internal/impl"
 )
 
 // Valid Label Options
@@ -27,32 +27,32 @@ var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be us
 // If the disabled flag is passed in, the process label will not be set, but the mount label will be set
 // to the container_file label with the maximum category. This label is not usable by any confined label.
 func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
-	if !selinux.GetEnabled() {
+	if !impl.GetEnabled() {
 		return "", "", nil
 	}
-	processLabel, mountLabel := selinux.ContainerLabels() //nolint:staticcheck // ContainerLabels will be moved to an internal package.
+	processLabel, mountLabel := impl.ContainerLabels()
 	if processLabel == "" {
 		// processLabel is required; if empty, do nothing.
 		return processLabel, mountLabel, nil
 	}
 	defer func() {
 		if retErr != nil {
-			selinux.ReleaseLabel(mountLabel)
+			impl.ReleaseLabel(mountLabel)
 		}
 	}()
-	pcon, err := selinux.NewContext(processLabel)
+	pcon, err := impl.NewContext(processLabel)
 	if err != nil {
 		return "", "", err
 	}
 	mcsLevel := pcon["level"]
-	mcon, err := selinux.NewContext(mountLabel)
+	mcon, err := impl.NewContext(mountLabel)
 	if err != nil {
 		return "", "", err
 	}
 	for _, opt := range options {
 		if opt == "disable" {
-			selinux.ReleaseLabel(mountLabel)
-			return "", selinux.PrivContainerMountLabel(), nil
+			impl.ReleaseLabel(mountLabel)
+			return "", impl.PrivContainerMountLabel(), nil
 		}
 		k, v, ok := strings.Cut(opt, ":")
 		if !ok || !validOptions[k] {
@@ -69,9 +69,9 @@ func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
 	}
 	if p := pcon.Get(); p != processLabel {
 		if pcon["level"] != mcsLevel {
-			selinux.ReleaseLabel(processLabel)
+			impl.ReleaseLabel(processLabel)
 		}
-		if err := selinux.ReserveLabelV2(p); err != nil {
+		if err := impl.ReserveLabel(p); err != nil {
 			return "", "", err
 		}
 		processLabel = p
@@ -82,18 +82,18 @@ func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
 
 // SetFileLabel modifies the "path" label to the specified file label
 func SetFileLabel(path string, fileLabel string) error {
-	if !selinux.GetEnabled() || fileLabel == "" {
+	if !impl.GetEnabled() || fileLabel == "" {
 		return nil
 	}
-	return selinux.SetFileLabel(path, fileLabel)
+	return impl.SetFileLabel(path, fileLabel)
 }
 
 // SetFileCreateLabel tells the kernel the label for all files to be created
 func SetFileCreateLabel(fileLabel string) error {
-	if !selinux.GetEnabled() {
+	if !impl.GetEnabled() {
 		return nil
 	}
-	return selinux.SetFSCreateLabel(fileLabel)
+	return impl.SetFSCreateLabel(fileLabel)
 }
 
 // Relabel changes the label of path and all the entries beneath the path.
@@ -102,20 +102,20 @@ func SetFileCreateLabel(fileLabel string) error {
 //
 // The path itself is guaranteed to be relabeled last.
 func Relabel(path string, fileLabel string, shared bool) error {
-	if !selinux.GetEnabled() || fileLabel == "" {
+	if !impl.GetEnabled() || fileLabel == "" {
 		return nil
 	}
 
 	if shared {
-		c, err := selinux.NewContext(fileLabel)
+		c, err := impl.NewContext(fileLabel)
 		if err != nil {
 			return err
 		}
 
 		c["level"] = "s0"
 		fileLabel = c.Get()
 	}
-	return selinux.Chcon(path, fileLabel, true)
+	return impl.Chcon(path, fileLabel, true)
 }
 
 // Validate checks that the label does not include unexpected options

go-selinux/label/label_linux_test.go

@@ -5,12 +5,12 @@ import (
 	"os"
 	"testing"
 
-	"github.com/opencontainers/selinux/go-selinux"
+	"github.com/opencontainers/selinux/internal/impl"
 )
 
 func needSELinux(t *testing.T) {
 	t.Helper()
-	if !selinux.GetEnabled() {
+	if !impl.GetEnabled() {
 		t.Skip("SELinux not enabled, skipping.")
 	}
 }