Skip to content

Add ChangeLabelType#271

Open
kolyshkin wants to merge 1 commit into
opencontainers:mainfrom
kolyshkin:change-type
Open

Add ChangeLabelType#271
kolyshkin wants to merge 1 commit into
opencontainers:mainfrom
kolyshkin:change-type

Conversation

@kolyshkin
Copy link
Copy Markdown
Collaborator

@kolyshkin kolyshkin commented May 12, 2026

All (open source) users of KVMContainerLabel[s] and InitContainerLabel[s] (containerd, podman, and cri-o) are immediately releasing the acquired MCS. They only need the type field, so they can change the existing label to that type. Everything else, including the just-generated unique MCS label, is not used.

Introduce ChangeLabelType which does just what all those users need.

Fixes: #266

Testing this:

@kolyshkin kolyshkin added this to the v1.15.0 milestone May 12, 2026
@kolyshkin kolyshkin force-pushed the change-type branch 2 times, most recently from 7ca5651 to f07753b Compare May 12, 2026 21:42
Comment thread go-selinux/selinux.go Outdated
type LabelType int

const (
TypeProcess LabelType = iota + 1
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm always a bit cautious on using iota for public API; go makes it easy to still allow untyped integers to be used (or to be cast to the right type), so if the order would ever change, that could break uses, and wouldn't be immediately obvious here.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you want to add a test case to check the order hasn't changed? Or would you prefer to not use iota at all?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps no iota at all, and just explicitly set the values; although I don't expect it to happen in this repository, I've been bit a few times by cases where values were implicitly changed (e.g. some refactor sorting consts, or someone adding a new consts somewhere in between).

While technically we could consider the consts to be the contract, I have seen situations where values were either hard-coded, or (not sure if that can happen for this one) persisted, so updating the values would (sometimes subtly) break those cases.

Explicitly setting values reduces the temptation to update values as it's more clear that changing them means you're changing the API.

(Hope I make sense 😅)

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You do make sense; yet I still like iota because it's concise. I think we can prevent the values being changed by adding a test case.

Well, after adding a test case it's no so concise (if we count the test as well).

Switched to numbers.

@kolyshkin
Copy link
Copy Markdown
Collaborator Author

All (open source) users of KVMContainerLabel[s] and InitContainerLabel[s]
(containerd, podman, and cri-o) are immediately releasing the acquired
MCS. They only need the type field, so they can change the existing
label to that type. Everything else, including the just-generated unique
MCS label, is not used.

Introduce ChangeLabelType which does just what all those users need.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RFC: introduce ChangeContainerLabelType

2 participants