fix: uniqMcs use all cpu

go-selinux/label/label_linux.go

@@ -17,6 +17,7 @@ var validOptions = map[string]bool{
 	"role":     true,
 	"level":    true,
 }
+var maxSelinuxLabelSize = int(selinux.CategoryRange * (selinux.CategoryRange - 1) / 2)
 
 var ErrIncompatibleLabel = errors.New("bad SELinux option: z and Z can not be used together")
 
@@ -30,6 +31,9 @@ func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
 	if !selinux.GetEnabled() {
 		return "", "", nil
 	}
+	if size := selinux.ContainerLabelsSize(); size >= maxSelinuxLabelSize {
+		return "", "", fmt.Errorf("SELinux label exhaustion: %d labels used", size)
+	}
 	processLabel, mountLabel := selinux.ContainerLabels()
 	if processLabel != "" {
 		defer func() {

go-selinux/label/label_linux_test.go

@@ -3,6 +3,7 @@ package label
 import (
 	"errors"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/opencontainers/selinux/go-selinux"
@@ -53,6 +54,22 @@ func TestInit(t *testing.T) {
 	}
 }
 
+func TestSELinuxLabelExhaustion(t *testing.T) {
+	needSELinux(t)
+	selinux.CategoryRange = 5
+	var testNull []string
+	for i := 0; i < 20; i++ {
+		_, _, err := InitLabels(testNull)
+		if i == 19 {
+			if err == nil {
+				t.Fatal("err should not be nil")
+			} else if !strings.Contains(err.Error(), "SELinux label exhaustion") {
+				t.Fatalf("unexpected error %s", err.Error())
+			}
+		}
+	}
+}
+
 func TestRelabel(t *testing.T) {
 	needSELinux(t)
 

go-selinux/selinux_linux.go

@@ -43,7 +43,7 @@ type selinuxState struct {
 	selinuxfsOnce sync.Once
 	enabledSet    bool
 	enabled       bool
-	sync.Mutex
+	sync.RWMutex
 }
 
 type level struct {
@@ -85,6 +85,12 @@ var (
 	labels         map[string]string
 )
 
+func ContainerLabelsSize() int {
+	state.RLock()
+	defer state.RUnlock()
+	return len(state.mcsList)
+}
+
 func policyRoot() string {
 	policyRootOnce.Do(func() {
 		policyRootVal = filepath.Join(selinuxDir, readConfig(selinuxTypeTag))