Skip to content

bump oc/selinux to v1.15.0, remove !linux wrappers #6864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
giuseppe merged 2 commits into from
May 28, 2026
Merged

bump oc/selinux to v1.15.0, remove !linux wrappers #6864

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aae93b5
deps: bump oc/selinux to v1.15.0
kolyshkin May 21, 2026
b92924f
selinux: simplify code
kolyshkin May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ require (
github.com/opencontainers/runc v1.4.2
github.com/opencontainers/runtime-spec v1.3.0
github.com/opencontainers/runtime-tools v0.9.1-0.20260316125833-8a4db579f5c8
github.com/opencontainers/selinux v1.14.1
github.com/opencontainers/selinux v1.15.0
github.com/openshift/imagebuilder v1.2.21
github.com/seccomp/libseccomp-golang v0.11.1
github.com/sirupsen/logrus v1.9.4
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,8 +197,8 @@ github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5
github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/runtime-tools v0.9.1-0.20260316125833-8a4db579f5c8 h1:2NAWFjN0PmdIe3XojVL9wf3lJ1//VqAgc7MOSYHQslE=
github.com/opencontainers/runtime-tools v0.9.1-0.20260316125833-8a4db579f5c8/go.mod h1:DKDEfzxvRkoQ6n9TGhxQgg2IM1lY4aM0eaQP4e3oElw=
github.com/opencontainers/selinux v1.14.1 h1:a7XlXV/nN/l5zFP1FWZYoExpClu1QOPMfWUV2CZ8kEQ=
github.com/opencontainers/selinux v1.14.1/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZKumHcKMQtnaDlQQ=
github.com/opencontainers/selinux v1.15.0 h1:4Gs40e/R2FvM8PC1HPaPncLLaDor8Y2WDfk5gjU9o5M=
github.com/opencontainers/selinux v1.15.0/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZKumHcKMQtnaDlQQ=
github.com/openshift/imagebuilder v1.2.21 h1:XX0tZVznWTxzYevvNVZ/0eeTzmgY6cfcT4/xjs5ToyU=
github.com/openshift/imagebuilder v1.2.21/go.mod h1:+L09sXUQ0RPdCU1tmzKrfBhqMlYvZtaA3MHb7aTjVU8=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand Down
13 changes: 4 additions & 9 deletions selinux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,25 @@
//go:build linux

package buildah

import (
"errors"
"fmt"
"os"
"runtime"

"github.com/opencontainers/runtime-tools/generate"
selinux "github.com/opencontainers/selinux/go-selinux"
)

func selinuxGetEnabled() bool {
return selinux.GetEnabled()
}

func setupSelinux(g *generate.Generator, processLabel, mountLabel string) {
if processLabel != "" && selinux.GetEnabled() {
if runtime.GOOS == "linux" && processLabel != "" && selinux.GetEnabled() {
g.SetProcessSelinuxLabel(processLabel)
g.SetLinuxMountLabel(mountLabel)
}
}

func runLabelStdioPipes(stdioPipe [][]int, processLabel, mountLabel string) error {

@mtrmac mtrmac May 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code with /proc/self/fd remains Linux-specific (although unreachable on other platforms due to selinux.GetEnabled()). I’ll leave it to Buildah maintainers to decide whether they prefer strict platform separation or to avoid the extra stub.

@kolyshkin kolyshkin May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that's a concern, I've added another guard (runtime.GOOS == "linux") which has zero runtime overhead because runtime.GOOS is a constant, so the compiled code should be identical to what we had before.

if !selinuxGetEnabled() || processLabel == "" || mountLabel == "" {
// SELinux is completely disabled, or we're not doing anything at all with labeling
if runtime.GOOS != "linux" || !selinux.GetEnabled() || processLabel == "" || mountLabel == "" {
// Not on Linux, or SELinux is disabled, or empty labels.
return nil
}
pipeContext, err := selinux.ComputeCreateContext(processLabel, mountLabel, "fifo_file")
Expand Down
18 changes: 0 additions & 18 deletions selinux_unsupported.go
View file
Open in desktop

This file was deleted.

11 changes: 8 additions & 3 deletions vendor/github.com/opencontainers/selinux/go-selinux/label/label_linux.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

19 changes: 19 additions & 0 deletions vendor/github.com/opencontainers/selinux/go-selinux/selinux.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

43 changes: 43 additions & 0 deletions vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion vendor/modules.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,7 +322,7 @@ github.com/opencontainers/runtime-spec/specs-go
github.com/opencontainers/runtime-tools/generate
github.com/opencontainers/runtime-tools/generate/seccomp
github.com/opencontainers/runtime-tools/validate/capabilities
# github.com/opencontainers/selinux v1.14.1
# github.com/opencontainers/selinux v1.15.0
## explicit; go 1.22
github.com/opencontainers/selinux/go-selinux
github.com/opencontainers/selinux/go-selinux/label
Expand Down
Loading