Fix applying SELinux label for MPS

If /sys/fs/selinux is not RW-mounted, SELinux will always appear
disabled in a container. Trying to apply the label using
go-selinux library fails with `lsetxattr /mps/nvidia.com/gpu/pipe:
invalid argument`. Executing the command, on the other hand, does
not fail and applies the label successfully. MPS server and
clients can run, the client processes have type `M+C` as expected.

If /sys/fs/selinux is not mounted, skip applying the label.

Signed-off-by: Vitaliy Emporopulo <[email protected]>

cmd/mps-control-daemon/mps/daemon.go

@@ -18,13 +18,13 @@ package mps
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
 
-	"github.com/opencontainers/selinux/go-selinux"
 	"k8s.io/klog/v2"
 
 	"github.com/NVIDIA/k8s-device-plugin/internal/rm"
@@ -98,10 +98,8 @@ func (d *Daemon) Start() error {
 		return fmt.Errorf("error creating directory %v: %w", pipeDir, err)
 	}
 
-	if selinux.EnforceMode() == selinux.Enforcing {
-		if err := selinux.Chcon(pipeDir, "container_file_t", true); err != nil {
-			return fmt.Errorf("error setting SELinux context: %w", err)
-		}
+	if err := setSELinuxContext(pipeDir, "container_file_t"); err != nil {
+		return fmt.Errorf("error setting SELinux context: %w", err)
 	}
 
 	logDir := d.LogDir()
@@ -143,6 +141,26 @@ func (d *Daemon) Start() error {
 	return nil
 }
 
+func setSELinuxContext(path string, context string) error {
+	_, err := os.Stat("/sys/fs/selinux")
+	if err != nil && errors.Is(err, os.ErrNotExist) {
+		klog.InfoS("SELinux disabled, not updating context", "path", path)
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("error checking if SELinux is enabled: %w", err)
+	}
+
+	klog.InfoS("SELinux enabled, setting context", "path", path, "context", context)
+	chconCmd := exec.Command("chcon", "-R", "-t", context, path)
+	output, err := chconCmd.CombinedOutput()
+	if err != nil {
+		klog.Errorf("\n%v", string(output))
+		return err
+	}
+
+	return nil
+}
+
 // Stop ensures that the MPS daemon is quit.
 func (d *Daemon) Stop() error {
 	_, err := d.EchoPipeToControl("quit")

go.mod

@@ -10,7 +10,6 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/google/renameio v1.0.1
 	github.com/google/uuid v1.6.0
-	github.com/opencontainers/selinux v1.11.0
 	github.com/prometheus/procfs v0.15.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.9.0