Refactor pkg/util/selinux

pkg/util/selinux/doc.go

@@ -14,5 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Package selinux contains selinux utility functions.
+// Package selinux contains wrapper functions for the libcontainer SELinux
+// package.  A NOP implementation is provided for non-linux platforms.
 package selinux // import "k8s.io/kubernetes/pkg/util/selinux"

pkg/util/selinux/selinux.go

@@ -16,14 +16,24 @@ limitations under the License.
 
 package selinux
 
-// SelinuxContextRunner knows how to chcon of a directory and
-// how to get the selinux context of a file.
-type SelinuxContextRunner interface {
-	SetContext(dir, context string) error
+// Note: the libcontainer SELinux package is only built for Linux, so it is
+// necessary to have a NOP wrapper which is built for non-Linux platforms to
+// allow code that links to this package not to differentiate its own methods
+// for Linux and non-Linux platforms.
+//
+// SELinuxRunner wraps certain libcontainer SELinux calls. For more
+// information, see:
+//
+// https://github.com/opencontainers/runc/blob/master/libcontainer/selinux/selinux.go
+type SELinuxRunner interface {
+	// Getfilecon returns the SELinux context for the given path or returns an
+	// error.
 	Getfilecon(path string) (string, error)
 }
 
-// NewSelinuxContextRunner returns a new chconRunner.
-func NewSelinuxContextRunner() SelinuxContextRunner {
-	return &realSelinuxContextRunner{}
+// NewSELinuxRunner returns a new SELinuxRunner appropriate for the platform.
+// On Linux, all methods short-circuit and return NOP values if SELinux is
+// disabled. On non-Linux platforms, a NOP implementation is returned.
+func NewSELinuxRunner() SELinuxRunner {
+	return &realSELinuxRunner{}
 }

pkg/util/selinux/selinux_linux.go

@@ -19,25 +19,34 @@ limitations under the License.
 package selinux
 
 import (
-	"fmt"
-
 	"github.com/opencontainers/runc/libcontainer/selinux"
 )
 
-type realSelinuxContextRunner struct{}
-
-func (_ *realSelinuxContextRunner) SetContext(dir, context string) error {
-	// If SELinux is not enabled, return an empty string
-	if !selinux.SelinuxEnabled() {
-		return nil
-	}
-
-	return selinux.Setfilecon(dir, context)
+// SELinuxEnabled returns whether SELinux is enabled on the system.  SELinux
+// has a tri-state:
+//
+// 1.  disabled: SELinux Kernel modules not loaded, SELinux policy is not
+//     checked during Kernel MAC checks
+// 2.  enforcing: Enabled; SELinux policy violations are denied and logged
+//     in the audit log
+// 3.  permissive: Enabled, but SELinux policy violations are permitted and
+//     logged in the audit log
+//
+// SELinuxEnabled returns true if SELinux is enforcing or permissive, and
+// false if it is disabled.
+func SELinuxEnabled() bool {
+	return selinux.SelinuxEnabled()
 }
 
-func (_ *realSelinuxContextRunner) Getfilecon(path string) (string, error) {
-	if !selinux.SelinuxEnabled() {
-		return "", fmt.Errorf("SELinux is not enabled")
+// realSELinuxRunner is the real implementation of SELinuxRunner interface for
+// Linux.
+type realSELinuxRunner struct{}
+
+var _ SELinuxRunner = &realSELinuxRunner{}
+
+func (_ *realSELinuxRunner) Getfilecon(path string) (string, error) {
+	if !SELinuxEnabled() {
+		return "", nil
 	}
 	return selinux.Getfilecon(path)
 }

pkg/util/selinux/selinux_unsupported.go

@@ -18,14 +18,16 @@ limitations under the License.
 
 package selinux
 
-type realSelinuxContextRunner struct{}
-
-func (_ *realSelinuxContextRunner) SetContext(dir, context string) error {
-	// NOP
-	return nil
+// SELinuxEnabled always returns false on non-linux platforms.
+func SELinuxEnabled() bool {
+	return false
 }
 
-func (_ *realSelinuxContextRunner) Getfilecon(path string) (string, error) {
-	// NOP
+// realSELinuxRunner is the NOP implementation of the SELinuxRunner interface.
+type realSELinuxRunner struct{}
+
+var _ SELinuxRunner = &realSELinuxRunner{}
+
+func (_ *realSELinuxRunner) Getfilecon(path string) (string, error) {
 	return "", nil
 }