Merge pull request #380 from rhatdan/label

Free SELinux labels when the labels are not being used
projectatomic · Mar 26, 2021 · c1ed129 · c1ed129
2 parents f9f056e + 65efbb4
commit c1ed129
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/label/label_selinux.go b/vendor/src/github.com/opencontainers/runc/libcontainer/label/label_selinux.go
@@ -34,13 +34,16 @@ func InitLabels(options []string) (string, string, error) {
 		mcon := selinux.NewContext(mountLabel)
 		for _, opt := range options {
 			if opt == "disable" {
+				UnreserveLabel(processLabel)
 				return "", "", nil
 			}
 			if i := strings.Index(opt, ":"); i == -1 {
+				UnreserveLabel(processLabel)
 				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
 			}
 			con := strings.SplitN(opt, ":", 2)
 			if !validOptions[con[0]] {
+				UnreserveLabel(processLabel)
 				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])
 
 			}