Add option to checkpoint to specify SELinux label

checkpoint.go

@@ -41,6 +41,7 @@ checkpointed.`,
 		cli.StringFlag{Name: "manage-cgroups-mode", Value: "", Usage: "cgroups mode: 'soft' (default), 'full' and 'strict'"},
 		cli.StringSliceFlag{Name: "empty-ns", Usage: "create a namespace, but don't restore its properties"},
 		cli.BoolFlag{Name: "auto-dedup", Usage: "enable auto deduplication of memory images"},
+		cli.StringFlag{Name: "selinux-socket-label", Usage: "SELinux label for CRIU sockets"},
 	},
 	Action: func(context *cli.Context) error {
 		if err := checkArgs(context, 1, exactArgs); err != nil {

libcontainer/container_linux.go

@@ -26,6 +26,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/system"
 	"github.com/opencontainers/runc/libcontainer/utils"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/selinux/go-selinux/label"
 
 	"github.com/golang/protobuf/proto"
 	"github.com/sirupsen/logrus"
@@ -1385,11 +1386,34 @@ func (c *linuxContainer) criuSwrk(process *Process, req *criurpc.CriuReq, opts *
 		cmd.ExtraFiles = append(cmd.ExtraFiles, extraFiles...)
 	}
 
+	if opts != nil && opts.SELinuxSocketLabel != "" {
+		// If the container is running on a system with SELinux the sockets
+		// created by CRIU might need to be labelled correctly.
+		// CRIU opens a socket and the parasite code which is running in the
+		// process in the container, with the SELinux labelling of the container,
+		// tries to connect to this socket. Even if this is part of the parasite
+		// code, for SELinux it looks like the process in the container tries
+		// to randomly connect to sockets. Using this option the container engine
+		// above runc can tell how those sockets should be labelled and enable
+		// CRIU checkpointing.
+		if err := label.SetSocketLabel(opts.SELinuxSocketLabel); err != nil {
+			return errors.New("failed to set SELinux socket label for CRIU")
+		}
+	}
+
 	if err := cmd.Start(); err != nil {
 		return err
 	}
 	criuServer.Close()
 
+	if opts != nil && opts.SELinuxSocketLabel != "" {
+		// This resets the socket label to the default label. Only the sockets
+		// used by CRIU need a special labelling.
+		if err := label.SetSocketLabel(""); err != nil {
+			return errors.New("failed to reset SELinux socket label after CRIU")
+		}
+	}
+
 	defer func() {
 		criuClientCon.Close()
 		_, err := cmd.Process.Wait()

libcontainer/criu_opts_linux.go

@@ -37,4 +37,5 @@ type CriuOpts struct {
 	AutoDedup               bool               // auto deduplication for incremental dumps
 	LazyPages               bool               // restore memory pages lazily using userfaultfd
 	StatusFd                string             // fd for feedback when lazy server is ready
+	SELinuxSocketLabel      string             // if this is set runc will use this label to tell SELinux how to label new sockets
 }

man/runc-checkpoint.8.md

@@ -11,18 +11,19 @@ checkpointed.
    The checkpoint command saves the state of the container instance.
 
 # OPTIONS
-   --image-path value           path for saving criu image files
-   --work-path value            path for saving work files and logs
-   --parent-path value          path for previous criu image files in pre-dump
-   --leave-running              leave the process running after checkpointing
-   --tcp-established            allow open tcp connections
-   --ext-unix-sk                allow external unix sockets
-   --shell-job                  allow shell jobs
-   --lazy-pages                 use userfaultfd to lazily restore memory pages
-   --status-fd value            criu writes \0 to this FD once lazy-pages is ready
-   --page-server value          ADDRESS:PORT of the page server
-   --file-locks                 handle file locks, for safety
-   --pre-dump                   dump container's memory information only, leave the container running after this
-   --manage-cgroups-mode value  cgroups mode: 'soft' (default), 'full' and 'strict'
-   --empty-ns value             create a namespace, but don't restore its properties
-   --auto-dedup                 enable auto deduplication of memory images
+   --image-path value            path for saving criu image files
+   --work-path value             path for saving work files and logs
+   --parent-path value           path for previous criu image files in pre-dump
+   --leave-running               leave the process running after checkpointing
+   --tcp-established             allow open tcp connections
+   --ext-unix-sk                 allow external unix sockets
+   --shell-job                   allow shell jobs
+   --lazy-pages                  use userfaultfd to lazily restore memory pages
+   --status-fd value             criu writes \0 to this FD once lazy-pages is ready
+   --page-server value           ADDRESS:PORT of the page server
+   --file-locks                  handle file locks, for safety
+   --pre-dump                    dump container's memory information only, leave the container running after this
+   --manage-cgroups-mode value   cgroups mode: 'soft' (default), 'full' and 'strict'
+   --empty-ns value              create a namespace, but don't restore its properties
+   --auto-dedup                  enable auto deduplication of memory images
+   --selinux-socket-label value  SELinux label for CRIU sockets

restore.go

@@ -138,5 +138,6 @@ func criuOptions(context *cli.Context) *libcontainer.CriuOpts {
 		AutoDedup:               context.Bool("auto-dedup"),
 		LazyPages:               context.Bool("lazy-pages"),
 		StatusFd:                context.String("status-fd"),
+		SELinuxSocketLabel:      context.String("selinux-socket-label"),
 	}
 }

vendor.conf

@@ -4,7 +4,7 @@
 github.com/opencontainers/runtime-spec 29686dbc5559d93fb1ef402eeda3e35c38d75af4
 # Core libcontainer functionality.
 github.com/mrunalp/fileutils ed869b029674c0e9ce4c0dfa781405c2d9946d08
-github.com/opencontainers/selinux v1.0.0-rc1
+github.com/opencontainers/selinux v1.1
 github.com/seccomp/libseccomp-golang 84e90a91acea0f4e51e62bc1a75de18b1fc0790f
 github.com/sirupsen/logrus a3f95b5c423586578a4e099b11a46c2479628cac
 github.com/syndtr/gocapability db04d3cc01c8b54962a58ec7e491717d06cfcc16