Add granular control of SELinux labels for host mounts

[Juanadelacuesta]

Currently when using the podman task driver plugin if the selinuxlabel = "z" option is present in the volume configuration, all the host volume mounts will be forced to use SELinux shared volume context.

There is no way for operators to use the csi-hostpath plugin or any type of mount that is not compliant with the SELinux security, or mount a private volume. This PR introduces a new configuration option that can be set per volume mount, allowing to set different SELinux context to different volumes.

There will also be a PR on the nomad-driver-podman to read and apply the new configuration.

Closes:

• 184
• 185
• 208

[hashicorp-cla]

All committers have signed the CLA.

[tgross]

LGTM for the jobspec addition. But I think we want to add support for this flag with the docker driver (and maybe exec/java drivers too?) by making sure it's provided to the mounts the driver sets up (ex. driver.go#L1181-L1186)

Also, I think this might close out #9123 too. Probably a good idea to do a quick search thru open issues to see if there are others.

[tgross]

Little bit of debris to cleanup here.

[Juanadelacuesta]

I cant remove it :s

[tgross]

You can remove it if you flatten the commits. Or you can update your editor config so that you make sure it's always adding the newline EOF (you want that for posix-compliance... run wc -l on this file and you'll see it's one line short!)

[shoenig]

can be shortened to something like must.ErrorIs(t, tc.expectedErr, err)

[Juanadelacuesta]

must.ErrorIs doesn't work here, probably something with the unwarpping of the errors

[shoenig]

LGTM!

[lgfa29]

Do you have an example of how this error looks like? I'm not sure why we do it in some many parts of the code, but appending directly to mErr.Errors usually results in a bad error hierarchy.

[Juanadelacuesta]

it is actually called in the task group validation test, it should not be a problem

[lgfa29]

Suggested change

	mErr.Errors = append(mErr.Errors, errVolMountEmptyVol)
	}
	if !v.MountPropagationModeIsValid() {
	mErr.Errors = append(mErr.Errors, fmt.Errorf("%w: %q", errVolMountInvalidPropagationMode, v.PropagationMode))
	}
	if !v.SELinuxLabelIsValid() {
	mErr.Errors = append(mErr.Errors, fmt.Errorf("%w: \"%s\"", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))
	mErr= multierror.Append(mErr, errVolMountEmptyVol)
	}
	if !v.MountPropagationModeIsValid() {
	mErr = multierror.Append(mErr, fmt.Errorf("%w: %q", errVolMountInvalidPropagationMode, v.PropagationMode))
	}
	if !v.SELinuxLabelIsValid() {
	mErr= multierror.Append(mErr, fmt.Errorf("%w: \"%s\"", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))

Since this is new code, we may as well use the nicer method 😄