proposed fix

Signed-off-by: Kir Kolyshkin <[email protected]>

libcontainer/container_linux.go

@@ -11,12 +11,14 @@ import (
 	"path"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/selinux/go-selinux"
 	"github.com/sirupsen/logrus"
 	"github.com/vishvananda/netlink/nl"
 	"golang.org/x/sys/execabs"
@@ -512,7 +514,25 @@ func (c *Container) newParentProcess(p *Process) (parentProcess, error) {
 	} else {
 		var err error
 		if isDmzBinarySafe(c.config) {
+			if label := c.config.ProcessLabel; label != "" {
+				runtime.LockOSThread()
+				if err := selinux.SetFSCreateLabel(label); err != nil {
+					runtime.UnlockOSThread()
+					return nil, fmt.Errorf("unable to set selinux fs create label: %w", err)
+				}
+			}
 			dmzExe, err = dmz.Binary(c.stateDir)
+			if label := c.config.ProcessLabel; label != "" {
+				selinux.SetFSCreateLabel("")
+				runtime.UnlockOSThread()
+				// Check the label is as expected.
+				if dmzLabel, err2 := selinux.OpenedFileLabel(dmzExe); err2 != nil {
+					return nil, fmt.Errorf("unable to get dmz file label: %w", err)
+				} else if dmzLabel != label {
+					return nil, fmt.Errorf("runc-dmz file label mismatch: want %q, got %q", label, dmzLabel)
+				}
+			}
+
 			if err == nil {
 				// We can use our own executable without cloning if we are using
 				// runc-dmz.