From f528511bf6c7630408dc630d05197a49d39479c4 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Thu, 6 May 2021 17:41:04 -0400
Subject: [PATCH] Revert Patch to relabel if selinux not enabled

Revert : https://github.com/containers/podman/pull/9895

Turns out that if Docker is in --selinux-enabeled, it still relabels if
the user tells the system to, even if running a --privileged container
or if the selinux separation is disabled --security-opt label=disable.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 libpod/container_internal_linux.go | 10 ++--------
 test/system/410-selinux.bats       | 13 ++++++++-----
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index f0608e2b22..14816f6aab 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -377,14 +377,8 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 			case "z":
 				fallthrough
 			case "Z":
-				if c.MountLabel() != "" {
-					if c.ProcessLabel() != "" {
-						if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
-							return nil, err
-						}
-					} else {
-						logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
-					}
+				if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
+					return nil, err
 				}
 
 			default:
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 95233c1e63..f8cee0e59e 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -198,20 +198,23 @@ function check_label() {
     skip_if_no_selinux
 
     LABEL="system_u:object_r:tmp_t:s0"
+    RELABEL="system_u:object_r:container_file_t:s0"
     tmpdir=$PODMAN_TMPDIR/vol
     touch $tmpdir
     chcon -vR ${LABEL} $tmpdir
     ls -Z $tmpdir
 
     run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
-    level=$(secon -l $output)
     run ls -dZ ${tmpdir}
     is "$output" ${LABEL} "No Relabel Correctly"
 
-    run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current
-    level=$(secon -l $output)
+    run_podman run -v $tmpdir:/test:z --security-opt label=disable $IMAGE cat /proc/self/attr/current
+    run ls -dZ $tmpdir
+    is "$output" ${RELABEL} "Privileged Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:z --privileged $IMAGE cat /proc/self/attr/current
     run ls -dZ $tmpdir
-    is "$output" ${LABEL} "No Privileged Relabel Correctly"
+    is "$output" ${RELABEL} "Privileged Relabel Correctly"
 
     run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
     level=$(secon -l $output)
@@ -220,7 +223,7 @@ function check_label() {
 
     run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
     run ls -dZ $tmpdir
-    is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly"
+    is "$output" ${RELABEL} "Shared Relabel Correctly"
 }
 
 # vim: filetype=sh