Flake in TestSELinux, TestSocketLabel

[kolyshkin]

Reproduced the same issue with a different test case:

[kir@kir-tp1 go-selinux]$ go test  -run TestSELinux -count 10000 .
--- FAIL: TestSELinux (0.00s)
    selinux_linux_test.go:145: system_u:system_r:container_t:s0:c462,c874
    selinux_linux_test.go:146: system_u:object_r:container_file_t:s0:c462,c874
    selinux_linux_test.go:148: system_u:system_r:container_t:s0:c43,c985
    selinux_linux_test.go:149: system_u:object_r:container_file_t:s0:c43,c985
    selinux_linux_test.go:153: system_u:system_r:container_t:s0:c762,c778
    selinux_linux_test.go:154: system_u:object_r:container_file_t:s0:c762,c778
    selinux_linux_test.go:156: ClearLabels
    selinux_linux_test.go:158: system_u:system_r:container_t:s0:c494,c1001
    selinux_linux_test.go:159: system_u:object_r:container_file_t:s0:c494,c1001
    selinux_linux_test.go:163: PID:1817877 MCS:
    selinux_linux_test.go:168: SetFSCreateLabel failed write /proc/thread-self/attr/fscreate: permission denied
    selinux_linux_test.go:169: write /proc/thread-self/attr/fscreate: permission denied
--- FAIL: TestSELinux (0.00s)
    selinux_linux_test.go:145: system_u:system_r:container_t:s0:c714,c854
    selinux_linux_test.go:146: system_u:object_r:container_file_t:s0:c714,c854
    selinux_linux_test.go:148: system_u:system_r:container_t:s0:c152,c966
    selinux_linux_test.go:149: system_u:object_r:container_file_t:s0:c152,c966
    selinux_linux_test.go:153: system_u:system_r:container_t:s0:c252,c553
    selinux_linux_test.go:154: system_u:object_r:container_file_t:s0:c252,c553
    selinux_linux_test.go:156: ClearLabels
    selinux_linux_test.go:158: system_u:system_r:container_t:s0:c321,c912
    selinux_linux_test.go:159: system_u:object_r:container_file_t:s0:c321,c912
    selinux_linux_test.go:163: PID:1817877 MCS:
    selinux_linux_test.go:168: SetFSCreateLabel failed write /proc/thread-self/attr/fscreate: permission denied
    selinux_linux_test.go:169: write /proc/thread-self/attr/fscreate: permission denied
--- FAIL: TestSELinux (0.00s)
    selinux_linux_test.go:145: system_u:system_r:container_t:s0:c629,c969
    selinux_linux_test.go:146: system_u:object_r:container_file_t:s0:c629,c969
    selinux_linux_test.go:148: system_u:system_r:container_t:s0:c538,c916
    selinux_linux_test.go:149: system_u:object_r:container_file_t:s0:c538,c916
    selinux_linux_test.go:153: system_u:system_r:container_t:s0:c11,c844
    selinux_linux_test.go:154: system_u:object_r:container_file_t:s0:c11,c844
    selinux_linux_test.go:156: ClearLabels
    selinux_linux_test.go:158: system_u:system_r:container_t:s0:c172,c645
    selinux_linux_test.go:159: system_u:object_r:container_file_t:s0:c172,c645
    selinux_linux_test.go:163: PID:1817877 MCS:
    selinux_linux_test.go:166: unconfined_u:unconfined_r:unconfined_t:s0 <nil>
    selinux_linux_test.go:175: SetFSCreateLabel failed write /proc/thread-self/attr/fscreate: permission denied
    selinux_linux_test.go:176: write /proc/thread-self/attr/fscreate: permission denied
FAIL
FAIL	github.com/opencontainers/selinux/go-selinux	0.503s
FAIL

Originally posted by @kolyshkin in #222

[kolyshkin]

It was documented in #113 by @gitstashpop, but the test case was not amended, and can result in a flake.

A flake can easily be reproduced by go test -run TestSELinux -count 10000 ..

[kolyshkin]

Same issue with TestSocketLabel:

[kir@kir-tp1 label]$ go test  -count 10000 -run SocketLabel .
--- FAIL: TestSocketLabel (0.00s)
    label_linux_test.go:189: write /proc/thread-self/attr/sockcreate: permission denied
--- FAIL: TestSocketLabel (0.00s)
    label_linux_test.go:189: write /proc/thread-self/attr/sockcreate: permission denied
FAIL
FAIL	github.com/opencontainers/selinux/go-selinux/label	0.159s
FAIL

[rhatdan]

The code in Docker/Podman and friends that calls these functions, always lock the thread before it calls them to prevent these problems, as I recall.