server: Canonize selinux label for comparison with filesystem label

[manuelluis]

What type of PR is this?

/kind bug

What this PR does / why we need it:

If you try to use the annotation: io.kubernetes.cri-o.TrySkipVolumeSELinuxLabel, It doesn't work because, the selinux label with the mcs from the annotation in the namespace, has the wrong order in the mcs.

$ oc get project test -o yaml | grep mcs
openshift.io/sa.scc.mcs: s0:c75,c35

The selinux label for the comparison with the label in the filesystem will be: system_u:object_r:container_file_t:s0:c75,c35
but in the filesystem the label is: system_u:object_r:container_file_t:s0:c35,c75

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

None

Fixed `io.kubernetes.cri-o.TrySkipVolumeSELinuxLabel` annotation usage with the OpenShift MCS.

[openshift-ci]

Hi @manuelluis. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[haircommander]

should we Canonicalize this one as well, or do we think it'll be correct because we're reading it from disk (after it's been procesed by the kernel)

[manuelluis]

From what I've seen, the kernel always saves it in the correct order, even if the attribute is with the mcs out of order.
I don't know if there is any filesystem that can skip the kernel ordering and return the mcs in the wrong order.

[haircommander]

/ok-to-test

Thanks for opening tihs! approach LGTM. Maybe we should create a test in test/selinux.bats with the contexts inverted to make sure this is working orrectly. That can be a follow up if you'd like, or could be brought in with this. up to you @manuelluis

[haircommander]

/retest

[haircommander]

/approve

LGTM, @cri-o/cri-o-maintainers PTAL

[dmunne]

/retest

[haircommander]

@saschagrunert PTAL

[saschagrunert]

/lgtm
/retest-required

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, manuelluis, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [haircommander,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

Integration tests have been fixed in another PR.

[saschagrunert]

/test integration_fedora

[haircommander]

/cherry-pick release-1.23

[openshift-cherrypick-robot]

@haircommander: new pull request created: #5792

In response to this:

/cherry-pick release-1.23

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.