archive: ignore the security.selinux xattr

pkg/archive/archive.go

@@ -77,6 +77,10 @@ const (
 	containersOverrideXattr = "user.containers.override_stat"
 )
 
+var xattrsToIgnore = map[string]interface{}{
+	"security.selinux": true,
+}
+
 // Archiver allows the reuse of most utility functions of this package with a
 // pluggable Untar function.  To facilitate the passing of specific id mappings
 // for untar, an archiver can be created with maps which will then be passed to
@@ -743,6 +747,9 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, L
 
 	var errs []string
 	for key, value := range hdr.Xattrs {
+		if _, found := xattrsToIgnore[key]; found {
+			continue
+		}
 		if err := system.Lsetxattr(path, key, []byte(value), 0); err != nil {
 			if errors.Is(err, syscall.ENOTSUP) || (inUserns && errors.Is(err, syscall.EPERM)) {
 				// We ignore errors here because not all graphdrivers support

pkg/archive/archive_test.go

@@ -921,6 +921,26 @@ func BenchmarkTarUntarWithLinks(b *testing.B) {
 	}
 }
 
+func TestUntarSelinuxLabel(t *testing.T) {
+	xattrs := map[string]string{
+		"SCHILY.xattr.security.selinux": "invalid-label",
+	}
+	for i, headers := range [][]*tar.Header{
+		{
+			{
+				Name:       "foo",
+				Typeflag:   tar.TypeReg,
+				Mode:       0644,
+				PAXRecords: xattrs,
+			},
+		},
+	} {
+		if err := testBreakout("untar", "storage-TestUntarInvalidFilenames", headers); err != nil {
+			t.Fatalf("i=%d. %v", i, err)
+		}
+	}
+}
+
 func TestUntarInvalidFilenames(t *testing.T) {
 	// TODO Windows: Figure out how to fix this test.
 	if runtime.GOOS == windows {
@@ -1230,27 +1250,6 @@ func TestReplaceFileTarWrapper(t *testing.T) {
 	}
 }
 
-/*
-// TestPrefixHeaderReadable tests that files that could be created with the
-// version of this package that was built with <=go17 are still readable.
-func TestPrefixHeaderReadable(t *testing.T) {
-	// https://gist.github.com/stevvooe/e2a790ad4e97425896206c0816e1a882#file-out-go
-	var testFile = []byte("\x1f\x8b\x08\x08\x44\x21\x68\x59\x00\x03\x74\x2e\x74\x61\x72\x00\x4b\xcb\xcf\x67\xa0\x35\x30\x80\x00\x86\x06\x10\x47\x01\xc1\x37\x40\x00\x54\xb6\xb1\xa1\xa9\x99\x09\x48\x25\x1d\x40\x69\x71\x49\x62\x91\x02\xe5\x76\xa1\x79\x84\x21\x91\xd6\x80\x72\xaf\x8f\x82\x51\x30\x0a\x46\x36\x00\x00\xf0\x1c\x1e\x95\x00\x06\x00\x00")
-
-	tmpDir, err := ioutil.TempDir("", "prefix-test")
-	require.NoError(t, err)
-	defer os.RemoveAll(tmpDir)
-	err = Untar(bytes.NewReader(testFile), tmpDir, nil)
-	require.NoError(t, err)
-
-	baseName := "foo"
-	pth := strings.Repeat("a", 100-len(baseName)) + "/" + baseName
-
-	_, err = os.Lstat(filepath.Join(tmpDir, pth))
-	require.NoError(t, err)
-}
-*/
-
 func buildSourceArchive(t *testing.T, numberOfFiles int) (io.ReadCloser, func()) {
 	srcDir, err := ioutil.TempDir("", "storage-test-srcDir")
 	require.NoError(t, err)

pkg/chunked/storage_linux.go

@@ -57,6 +57,10 @@ type chunkedDiffer struct {
 	gzipReader *pgzip.Reader
 }
 
+var xattrsToIgnore = map[string]interface{}{
+	"security.selinux": true,
+}
+
 func timeToTimespec(time time.Time) (ts unix.Timespec) {
 	if time.IsZero() {
 		// Return UTIME_OMIT special value
@@ -280,10 +284,6 @@ func canDedupFileWithHardLink(file *internal.FileMetadata, fd int, s os.FileInfo
 		return false
 	}
 
-	xattrsToIgnore := map[string]interface{}{
-		"security.selinux": true,
-	}
-
 	xattrs := make(map[string]string)
 	for _, x := range listXattrs {
 		v, err := system.Lgetxattr(path, x)
@@ -578,6 +578,9 @@ func setFileAttrs(dirfd int, file *os.File, mode os.FileMode, metadata *internal
 	}
 
 	for k, v := range metadata.Xattrs {
+		if _, found := xattrsToIgnore[k]; found {
+			continue
+		}
 		data, err := base64.StdEncoding.DecodeString(v)
 		if err != nil {
 			return fmt.Errorf("decode xattr %q: %v", v, err)