From 6831c72f6acd211c34373a0f53f09b61222ce9bd Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Tue, 30 Mar 2021 16:46:52 -0400
Subject: [PATCH] Don't relabel volumes if running in a privileged container

Docker does not relabel this content, and openstack is running
containers in this manner.  There is a penalty for doing this
on each container, that is not worth taking on a disable SELinux
container.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 libpod/container_internal_linux.go | 10 ++++++++--
 test/system/410-selinux.bats       | 28 ++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index d167bf188b..4fc45e4f06 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 			case "z":
 				fallthrough
 			case "Z":
-				if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
-					return nil, err
+				if c.MountLabel() != "" {
+					if c.ProcessLabel() != "" {
+						if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
+							return nil, err
+						}
+					} else {
+						logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
+					}
 				}
 
 			default:
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 4a2c7b7a40..8a690fb481 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -191,5 +191,33 @@ function check_label() {
     is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic"
 }
 
+@test "podman selinux: check relabel" {
+    skip_if_no_selinux
+
+    LABEL="system_u:object_r:tmp_t:s0"
+    tmpdir=$PODMAN_TMPDIR/vol
+    touch $tmpdir
+    chcon -vR ${LABEL} $tmpdir
+    ls -Z $tmpdir
+
+    run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
+    level=$(secon -l $output)
+    run ls -dZ ${tmpdir}
+    is "$output" ${LABEL} "No Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current
+    level=$(secon -l $output)
+    run ls -dZ $tmpdir
+    is "$output" ${LABEL} "No Privileged Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
+    level=$(secon -l $output)
+    run ls -dZ $tmpdir
+    is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
+    run ls -dZ $tmpdir
+    is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly"
+}
 
 # vim: filetype=sh