containers
/
automation-tests
mirror of https://github.com/containers/automation-tests.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2381 from containers/renovate/github.com-opencontainers-selinux-1.x 

fix(deps): update module github.com/opencontainers/selinux to v1.12.0
This commit is contained in:
openshift-merge-bot[bot] 2025-03-24 11:36:02 +00:00 committed by GitHub
parent e45722295c 216ce3d872
commit c9a49cb1a1
8 changed files with 39 additions and 110 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common/go.mod
View File

@ -34,7 +34,7 @@ require (
github.com/opencontainers/runc v1.2.6
github.com/opencontainers/runtime-spec v1.2.1
github.com/opencontainers/runtime-tools v0.9.1-0.20241108202711-f7e3563b0271
github.com/opencontainers/selinux v1.11.1
github.com/opencontainers/selinux v1.12.0
github.com/pkg/sftp v1.13.8
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
github.com/seccomp/libseccomp-golang v0.10.0

4
common/go.sum
View File

@ -264,8 +264,8 @@ github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU
github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/runtime-tools v0.9.1-0.20241108202711-f7e3563b0271 h1:TPj0pMLCTy1CKwmrat3hqTxoZfqOuTy0asG0ccpGk8Q=
github.com/opencontainers/runtime-tools v0.9.1-0.20241108202711-f7e3563b0271/go.mod h1:oIH6VwKkaDOO+SIYZpdwrC/0wKYqrfO6E1sG1j3UVws=
github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f h1:/UDgs8FGMqwnHagNDPGOlts35QkhAZ8by3DR7nMih7M=
github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f/go.mod h1:J6OG6YJVEWopen4avK3VNQSnALmmjvniMmni/YFYAwc=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=

67
common/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go generated vendored
View File

@ -6,78 +6,11 @@ import (
"github.com/opencontainers/selinux/go-selinux"
)
// Deprecated: use selinux.ROFileLabel
var ROMountLabel = selinux.ROFileLabel
// SetProcessLabel takes a process label and tells the kernel to assign the
// label to the next program executed by the current process.
// Deprecated: use selinux.SetExecLabel
var SetProcessLabel = selinux.SetExecLabel
// ProcessLabel returns the process label that the kernel will assign
// to the next program executed by the current process. If "" is returned
// this indicates that the default labeling will happen for the process.
// Deprecated: use selinux.ExecLabel
var ProcessLabel = selinux.ExecLabel
// SetSocketLabel takes a process label and tells the kernel to assign the
// label to the next socket that gets created
// Deprecated: use selinux.SetSocketLabel
var SetSocketLabel = selinux.SetSocketLabel
// SocketLabel retrieves the current default socket label setting
// Deprecated: use selinux.SocketLabel
var SocketLabel = selinux.SocketLabel
// SetKeyLabel takes a process label and tells the kernel to assign the
// label to the next kernel keyring that gets created
// Deprecated: use selinux.SetKeyLabel
var SetKeyLabel = selinux.SetKeyLabel
// KeyLabel retrieves the current default kernel keyring label setting
// Deprecated: use selinux.KeyLabel
var KeyLabel = selinux.KeyLabel
// FileLabel returns the label for specified path
// Deprecated: use selinux.FileLabel
var FileLabel = selinux.FileLabel
// PidLabel will return the label of the process running with the specified pid
// Deprecated: use selinux.PidLabel
var PidLabel = selinux.PidLabel
// Init initialises the labeling system
func Init() {
_ = selinux.GetEnabled()
}
// ClearLabels will clear all reserved labels
// Deprecated: use selinux.ClearLabels
var ClearLabels = selinux.ClearLabels
// ReserveLabel will record the fact that the MCS label has already been used.
// This will prevent InitLabels from using the MCS label in a newly created
// container
// Deprecated: use selinux.ReserveLabel
func ReserveLabel(label string) error {
selinux.ReserveLabel(label)
return nil
}
// ReleaseLabel will remove the reservation of the MCS label.
// This will allow InitLabels to use the MCS label in a newly created
// containers
// Deprecated: use selinux.ReleaseLabel
func ReleaseLabel(label string) error {
selinux.ReleaseLabel(label)
return nil
}
// DupSecOpt takes a process label and returns security options that
// can be used to set duplicate labels on future container processes
// Deprecated: use selinux.DupSecOpt
var DupSecOpt = selinux.DupSecOpt
// FormatMountLabel returns a string to be used by the mount command. Using
// the SELinux `context` mount option. Changing labels of files on mount
// points with this option can never be changed.

11
common/vendor/github.com/opencontainers/selinux/go-selinux/label/label_linux.go generated vendored
View File

@ -79,12 +79,6 @@ func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
return processLabel, mountLabel, nil
}
// Deprecated: The GenLabels function is only to be used during the transition
// to the official API. Use InitLabels(strings.Fields(options)) instead.
func GenLabels(options string) (string, string, error) {
return InitLabels(strings.Fields(options))
}
// SetFileLabel modifies the "path" label to the specified file label
func SetFileLabel(path string, fileLabel string) error {
if !selinux.GetEnabled() || fileLabel == "" {
@ -123,11 +117,6 @@ func Relabel(path string, fileLabel string, shared bool) error {
return selinux.Chcon(path, fileLabel, true)
}
// DisableSecOpt returns a security opt that can disable labeling
// support for future container processes
// Deprecated: use selinux.DisableSecOpt
var DisableSecOpt = selinux.DisableSecOpt
// Validate checks that the label does not include unexpected options
func Validate(label string) error {
if strings.Contains(label, "z") && strings.Contains(label, "Z") {

6
common/vendor/github.com/opencontainers/selinux/go-selinux/label/label_stub.go generated vendored
View File

@ -10,12 +10,6 @@ func InitLabels([]string) (string, string, error) {
return "", "", nil
}
// Deprecated: The GenLabels function is only to be used during the transition
// to the official API. Use InitLabels(strings.Fields(options)) instead.
func GenLabels(string) (string, string, error) {
return "", "", nil
}
func SetFileLabel(string, string) error {
return nil
}

16
common/vendor/github.com/opencontainers/selinux/go-selinux/selinux.go generated vendored
View File

@ -41,6 +41,10 @@ var (
// ErrVerifierNil is returned when a context verifier function is nil.
ErrVerifierNil = errors.New("verifier function is nil")
// ErrNotTGLeader is returned by [SetKeyLabel] if the calling thread
// is not the thread group leader.
ErrNotTGLeader = errors.New("calling thread is not the thread group leader")
// CategoryRange allows the upper bound on the category range to be adjusted
CategoryRange = DefaultCategoryRange
@ -180,10 +184,14 @@ func PeerLabel(fd uintptr) (string, error) {
}
// SetKeyLabel takes a process label and tells the kernel to assign the
// label to the next kernel keyring that gets created. Calls to SetKeyLabel
// should be wrapped in runtime.LockOSThread()/runtime.UnlockOSThread() until
// the kernel keyring is created to guarantee another goroutine does not migrate
// to the current thread before execution is complete.
// label to the next kernel keyring that gets created.
//
// Calls to SetKeyLabel should be wrapped in
// runtime.LockOSThread()/runtime.UnlockOSThread() until the kernel keyring is
// created to guarantee another goroutine does not migrate to the current
// thread before execution is complete.
//
// Only the thread group leader can set key label.
func SetKeyLabel(label string) error {
return setKeyLabel(label)
}

41
common/vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go generated vendored
View File

@ -45,7 +45,7 @@ type selinuxState struct {
type level struct {
cats *big.Int
sens uint
sens int
}
type mlsRange struct {
@ -138,6 +138,7 @@ func verifySELinuxfsMount(mnt string) bool {
return false
}
//#nosec G115 -- there is no overflow here.
if uint32(buf.Type) != uint32(unix.SELINUX_MAGIC) {
return false
}
@ -501,14 +502,14 @@ func catsToBitset(cats string) (*big.Int, error) {
return nil, err
}
for i := catstart; i <= catend; i++ {
bitset.SetBit(bitset, int(i), 1)
bitset.SetBit(bitset, i, 1)
}
} else {
cat, err := parseLevelItem(ranges[0], category)
if err != nil {
return nil, err
}
bitset.SetBit(bitset, int(cat), 1)
bitset.SetBit(bitset, cat, 1)
}
}
@ -516,16 +517,17 @@ func catsToBitset(cats string) (*big.Int, error) {
}
// parseLevelItem parses and verifies that a sensitivity or category are valid
func parseLevelItem(s string, sep levelItem) (uint, error) {
func parseLevelItem(s string, sep levelItem) (int, error) {
if len(s) < minSensLen || levelItem(s[0]) != sep {
return 0, ErrLevelSyntax
}
val, err := strconv.ParseUint(s[1:], 10, 32)
const bitSize = 31 // Make sure the result fits into signed int32.
val, err := strconv.ParseUint(s[1:], 10, bitSize)
if err != nil {
return 0, err
}
return uint(val), nil
return int(val), nil
}
// parseLevel fills a level from a string that contains
@ -582,7 +584,8 @@ func bitsetToStr(c *big.Int) string {
var str string
length := 0
for i := int(c.TrailingZeroBits()); i < c.BitLen(); i++ {
i0 := int(c.TrailingZeroBits()) //#nosec G115 -- don't expect TralingZeroBits to return values with highest bit set.
for i := i0; i < c.BitLen(); i++ {
if c.Bit(i) == 0 {
continue
}
@ -622,7 +625,7 @@ func (l *level) equal(l2 *level) bool {
// String returns an mlsRange as a string.
func (m mlsRange) String() string {
low := "s" + strconv.Itoa(int(m.low.sens))
low := "s" + strconv.Itoa(m.low.sens)
if m.low.cats != nil && m.low.cats.BitLen() > 0 {
low += ":" + bitsetToStr(m.low.cats)
}
@ -631,7 +634,7 @@ func (m mlsRange) String() string {
return low
}
high := "s" + strconv.Itoa(int(m.high.sens))
high := "s" + strconv.Itoa(m.high.sens)
if m.high.cats != nil && m.high.cats.BitLen() > 0 {
high += ":" + bitsetToStr(m.high.cats)
}
@ -639,15 +642,16 @@ func (m mlsRange) String() string {
return low + "-" + high
}
// TODO: remove min and max once Go < 1.21 is not supported.
func max(a, b uint) uint {
// TODO: remove these in favor of built-in min/max
// once we stop supporting Go < 1.21.
func maxInt(a, b int) int {
if a > b {
return a
}
return b
}
func min(a, b uint) uint {
func minInt(a, b int) int {
if a < b {
return a
}
@ -676,10 +680,10 @@ func calculateGlbLub(sourceRange, targetRange string) (string, error) {
outrange := &mlsRange{low: &level{}, high: &level{}}
/* take the greatest of the low */
outrange.low.sens = max(s.low.sens, t.low.sens)
outrange.low.sens = maxInt(s.low.sens, t.low.sens)
/* take the least of the high */
outrange.high.sens = min(s.high.sens, t.high.sens)
outrange.high.sens = minInt(s.high.sens, t.high.sens)
/* find the intersecting categories */
if s.low.cats != nil && t.low.cats != nil {
@ -731,6 +735,9 @@ func setKeyLabel(label string) error {
if label == "" && errors.Is(err, os.ErrPermission) {
return nil
}
if errors.Is(err, unix.EACCES) && unix.Getuid() != unix.Gettid() {
return ErrNotTGLeader
}
return err
}
@ -809,8 +816,7 @@ func enforceMode() int {
// setEnforceMode sets the current SELinux mode Enforcing, Permissive.
// Disabled is not valid, since this needs to be set at boot time.
func setEnforceMode(mode int) error {
//nolint:gosec // ignore G306: permissions to be 0600 or less.
return os.WriteFile(selinuxEnforcePath(), []byte(strconv.Itoa(mode)), 0o644)
return os.WriteFile(selinuxEnforcePath(), []byte(strconv.Itoa(mode)), 0)
}
// defaultEnforceMode returns the systems default SELinux mode Enforcing,
@ -1017,8 +1023,7 @@ func addMcs(processLabel, fileLabel string) (string, string) {
// securityCheckContext validates that the SELinux label is understood by the kernel
func securityCheckContext(val string) error {
//nolint:gosec // ignore G306: permissions to be 0600 or less.
return os.WriteFile(filepath.Join(getSelinuxMountPoint(), "context"), []byte(val), 0o644)
return os.WriteFile(filepath.Join(getSelinuxMountPoint(), "context"), []byte(val), 0)
}
// copyLevel returns a label with the MLS/MCS level from src label replaced on

2
common/vendor/modules.txt vendored
View File

@ -543,7 +543,7 @@ github.com/opencontainers/runtime-spec/specs-go
github.com/opencontainers/runtime-tools/generate
github.com/opencontainers/runtime-tools/generate/seccomp
github.com/opencontainers/runtime-tools/validate/capabilities
# github.com/opencontainers/selinux v1.11.1
# github.com/opencontainers/selinux v1.12.0
## explicit; go 1.19
github.com/opencontainers/selinux/go-selinux
github.com/opencontainers/selinux/go-selinux/label