selinux: switch to opencontainers/go-selinux

[lucab]

While touching rkt code, I realized there is an embedded copy of libcontainer selinux package. The two versions are now diverging, and I would like to reconcile/contribute back.

Looking at the code, it looks like most of it isn't container specific and could be nicely split into its own module. Would you be ok in splitting this out in a self-standing selinux module? I'd be happy to submit current rkt changes into that and getting rid of existing forks.

[cyphar]

WDYT @rhatdan

Presumably this would live in opencontainers/selinux-golang or something like that, and all of the current runC maintainers would maintain that package too.

[rhatdan]

Fine with me.

[cyphar]

/cc @caniszczyk @crosbymichael

[lucab]

@cyphar any news on this? Can the new repo see the light?

I'm certainly in favour of this living under the opencontainers umbrella, I just have some minor wish items:

• having a clear set of MAINTAINERS to ping (as I guess not all runc people would have interests in that)
• having tagged releases to help downstream consumers

[cyphar]

I'm still waiting for a response from @caniszczyk and @crosbymichael. From my view, if @rhatdan is fine with it, then I'm fine with it too.

[caniszczyk]

The @opencontainers/tob have the authorization to approve new projects, they would need to sign off it and we can move forward. @philips do you see anything wrong with this? This is essentially a utility package

[jonboulle]

This seems to be live (https://github.com/opencontainers/go-selinux/), except it hasn't been integrated back into this repository yet - is there a plan for that?

[lucab]

The first half of this has happened after opencontainers/tob#29, thus I've re-titled it for the remaining part.

[crosbymichael]

We just need to do the work not to re-integrate this back into runc. If someone has time it should be a very simple PR with the code vendored.

[vbatts]

I'm sure a PR would be welcome ;-)

…

On Wed, Mar 8, 2017 at 11:12 AM, Jonathan Boulle ***@***.***> wrote: This seems to be live (https://github.com/opencontainers/go-selinux/), except it hasn't been integrated back into this repository yet - is there a plan for that? — You are receiving this because you are on a team that was mentioned. Reply to this email directly, view it on GitHub <#897 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAEF6ROZalmLlX1kRHOpbxFWEeKmspR-ks5rjtNYgaJpZM4IxC2O> .

[crosbymichael]

@vbatts naw

[vbatts]

dang

[hqhq]

@crosbymichael @vbatts I'll do it today.

[rhatdan]

I would prefer the repository be renamed to selinux with a subdir of the golang bindings.
I have been requested to move container-selinux to this repo, but moving the policy to something named go-selinux, makes no sense.