@@ -43,7 +43,7 @@ import (

 	"github.com/docker/libnetwork/options"

 	"github.com/docker/libnetwork/types"

 	agentexec "github.com/docker/swarmkit/agent/exec"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 const configFileName = "config.v2.json"

@@ -17,7 +17,7 @@ import (

 	"github.com/docker/docker/pkg/symlink"

 	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/volume"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 	"golang.org/x/sys/unix"

 )

@@ -19,7 +19,7 @@ import (

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/runconfig"

 	"github.com/docker/libnetwork"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/pkg/errors"

 )

@@ -20,7 +20,7 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/runconfig"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 // CreateManagedContainer creates a container that is managed by a Service

@@ -155,6 +155,13 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (

 	return container, nil

 }

+func toHostConfigSelinuxLabels(labels []string) []string {

+	for i, l := range labels {

+		labels[i] = "label=" + l

+	}

+	return labels

+}

+

 func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) ([]string, error) {

 	for _, opt := range hostConfig.SecurityOpt {

 		con := strings.Split(opt, "=")

@@ -167,7 +174,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 	pidMode := hostConfig.PidMode

 	privileged := hostConfig.Privileged

 	if ipcMode.IsHost() || pidMode.IsHost() || privileged {

-		return label.DisableSecOpt(), nil

+		return toHostConfigSelinuxLabels(label.DisableSecOpt()), nil

 	}

 	var ipcLabel []string

@@ -181,7 +188,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 		}

 		ipcLabel = label.DupSecOpt(c.ProcessLabel)

 		if pidContainer == "" {

-			return ipcLabel, err

+			return toHostConfigSelinuxLabels(ipcLabel), err

 		}

 	}

 	if pidContainer != "" {

@@ -192,7 +199,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 		pidLabel = label.DupSecOpt(c.ProcessLabel)

 		if ipcContainer == "" {

-			return pidLabel, err

+			return toHostConfigSelinuxLabels(pidLabel), err

 		}

 	}

@@ -202,7 +209,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 				return nil, fmt.Errorf("--ipc and --pid containers SELinux labels aren't the same")

 			}

 		}

-		return pidLabel, nil

+		return toHostConfigSelinuxLabels(pidLabel), nil

 	}

 	return nil, nil

 }

@@ -12,7 +12,7 @@ import (

 	mounttypes "github.com/docker/docker/api/types/mount"

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/pkg/stringid"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 // createContainerPlatformSpecificSettings performs platform specific container create functionality

@@ -23,8 +23,8 @@ import (

 	"github.com/docker/libnetwork/netlabel"

 	"github.com/docker/libnetwork/netutils"

 	lntypes "github.com/docker/libnetwork/types"

-	"github.com/opencontainers/runc/libcontainer/label"

 	"github.com/opencontainers/runtime-spec/specs-go"

+	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/pkg/errors"

 )

@@ -41,9 +41,9 @@ import (

 	lntypes "github.com/docker/libnetwork/types"

 	"github.com/golang/protobuf/ptypes"

 	"github.com/opencontainers/runc/libcontainer/cgroups"

-	"github.com/opencontainers/runc/libcontainer/label"

 	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

+	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/pkg/errors"

 	"github.com/vishvananda/netlink"

 )

@@ -47,8 +47,8 @@ import (

 	"github.com/docker/docker/pkg/locker"

 	mountpk "github.com/docker/docker/pkg/mount"

-	"github.com/opencontainers/runc/libcontainer/label"

 	rsystem "github.com/opencontainers/runc/libcontainer/system"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 var (

@@ -28,7 +28,7 @@ import (

 	"github.com/docker/docker/pkg/mount"

 	"github.com/docker/docker/pkg/parsers"

 	"github.com/docker/go-units"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 func init() {

@@ -30,7 +30,7 @@ import (

 	"github.com/docker/docker/pkg/parsers"

 	units "github.com/docker/go-units"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 var (

@@ -21,7 +21,7 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/locker"

 	"github.com/docker/docker/pkg/mount"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 // This is a small wrapper over the NaiveDiffWriter that lets us have a custom

@@ -33,7 +33,7 @@ import (

 	"github.com/docker/docker/pkg/parsers/kernel"

 	units "github.com/docker/go-units"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 var (

@@ -9,7 +9,7 @@ import (

 	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/idtools"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 var (

@@ -19,7 +19,7 @@ import (

 	"github.com/docker/docker/pkg/mount"

 	"github.com/docker/docker/pkg/parsers"

 	zfs "github.com/mistifyio/go-zfs"

-	"github.com/opencontainers/runc/libcontainer/label"

+	"github.com/opencontainers/selinux/go-selinux/label"

 )

 type zfsOptions struct {

@@ -2,16 +2,16 @@

 package daemon

-import "github.com/opencontainers/runc/libcontainer/selinux"

+import "github.com/opencontainers/selinux/go-selinux"

 func selinuxSetDisabled() {

 	selinux.SetDisabled()

 }

 func selinuxFreeLxcContexts(label string) {

-	selinux.FreeLxcContexts(label)

+	selinux.ReleaseLabel(label)

 }

 func selinuxEnabled() bool {

-	return selinux.SelinuxEnabled()

+	return selinux.GetEnabled()

 }

@@ -143,3 +143,4 @@ github.com/xeipuuv/gojsonpointer e0fe6f68307607d540ed8eac07a342c33fa1b54a

 github.com/xeipuuv/gojsonreference e02fc20de94c78484cd5ffb007f8af96be030a45

 github.com/xeipuuv/gojsonschema 93e72a773fade158921402d6a24c819b48aba29d

 gopkg.in/yaml.v2 4c78c975fe7c825c6d1466c42be594d1d6f3aba6

+github.com/opencontainers/selinux ba1aefe8057f1d0cfb8e88d0ec1dc85925ef987d

deleted file mode 100644

@@ -1,84 +0,0 @@

-// +build !selinux !linux

-

-package label

-

-// InitLabels returns the process label and file labels to be used within

-// the container.  A list of options can be passed into this function to alter

-// the labels.

-func InitLabels(options []string) (string, string, error) {

-	return "", "", nil

-}

-

-func GetROMountLabel() string {

-	return ""

-}

-

-func GenLabels(options string) (string, string, error) {

-	return "", "", nil

-}

-

-func FormatMountLabel(src string, mountLabel string) string {

-	return src

-}

-

-func SetProcessLabel(processLabel string) error {

-	return nil

-}

-

-func GetFileLabel(path string) (string, error) {

-	return "", nil

-}

-

-func SetFileLabel(path string, fileLabel string) error {

-	return nil

-}

-

-func SetFileCreateLabel(fileLabel string) error {

-	return nil

-}

-

-func Relabel(path string, fileLabel string, shared bool) error {

-	return nil

-}

-

-func GetPidLabel(pid int) (string, error) {

-	return "", nil

-}

-

-func Init() {

-}

-

-func ReserveLabel(label string) error {

-	return nil

-}

-

-func UnreserveLabel(label string) error {

-	return nil

-}

-

-// DupSecOpt takes a process label and returns security options that

-// can be used to set duplicate labels on future container processes

-func DupSecOpt(src string) []string {

-	return nil

-}

-

-// DisableSecOpt returns a security opt that can disable labeling

-// support for future container processes

-func DisableSecOpt() []string {

-	return nil

-}

-

-// Validate checks that the label does not include unexpected options

-func Validate(label string) error {

-	return nil

-}

-

-// RelabelNeeded checks whether the user requested a relabel

-func RelabelNeeded(label string) bool {

-	return false

-}

-

-// IsShared checks that the label includes a "shared" mark

-func IsShared(label string) bool {

-	return false

-}

deleted file mode 100644

@@ -1,204 +0,0 @@

-// +build selinux,linux

-

-package label

-

-import (

-	"fmt"

-	"strings"

-

-	"github.com/opencontainers/runc/libcontainer/selinux"

-)

-

-// Valid Label Options

-var validOptions = map[string]bool{

-	"disable": true,

-	"type":    true,

-	"user":    true,

-	"role":    true,

-	"level":   true,

-}

-

-var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be used together")

-

-// InitLabels returns the process label and file labels to be used within

-// the container.  A list of options can be passed into this function to alter

-// the labels.  The labels returned will include a random MCS String, that is

-// guaranteed to be unique.

-func InitLabels(options []string) (string, string, error) {

-	if !selinux.SelinuxEnabled() {

-		return "", "", nil

-	}

-	processLabel, mountLabel := selinux.GetLxcContexts()

-	if processLabel != "" {

-		pcon := selinux.NewContext(processLabel)

-		mcon := selinux.NewContext(mountLabel)

-		for _, opt := range options {

-			if opt == "disable" {

-				return "", "", nil

-			}

-			if i := strings.Index(opt, ":"); i == -1 {

-				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)

-			}

-			con := strings.SplitN(opt, ":", 2)

-			if !validOptions[con[0]] {

-				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])

-

-			}

-			pcon[con[0]] = con[1]

-			if con[0] == "level" || con[0] == "user" {

-				mcon[con[0]] = con[1]

-			}

-		}

-		processLabel = pcon.Get()

-		mountLabel = mcon.Get()

-	}

-	return processLabel, mountLabel, nil

-}

-

-func GetROMountLabel() string {

-	return selinux.GetROFileLabel()

-}

-

-// DEPRECATED: The GenLabels function is only to be used during the transition to the official API.

-func GenLabels(options string) (string, string, error) {

-	return InitLabels(strings.Fields(options))

-}

-

-// FormatMountLabel returns a string to be used by the mount command.

-// The format of this string will be used to alter the labeling of the mountpoint.

-// The string returned is suitable to be used as the options field of the mount command.

-// If you need to have additional mount point options, you can pass them in as

-// the first parameter.  Second parameter is the label that you wish to apply

-// to all content in the mount point.

-func FormatMountLabel(src, mountLabel string) string {

-	if mountLabel != "" {

-		switch src {

-		case "":

-			src = fmt.Sprintf("context=%q", mountLabel)

-		default:

-			src = fmt.Sprintf("%s,context=%q", src, mountLabel)

-		}

-	}

-	return src

-}

-

-// SetProcessLabel takes a process label and tells the kernel to assign the

-// label to the next program executed by the current process.

-func SetProcessLabel(processLabel string) error {

-	if processLabel == "" {

-		return nil

-	}

-	return selinux.Setexeccon(processLabel)

-}

-

-// GetProcessLabel returns the process label that the kernel will assign

-// to the next program executed by the current process.  If "" is returned

-// this indicates that the default labeling will happen for the process.

-func GetProcessLabel() (string, error) {

-	return selinux.Getexeccon()

-}

-

-// GetFileLabel returns the label for specified path

-func GetFileLabel(path string) (string, error) {

-	return selinux.Getfilecon(path)

-}

-

-// SetFileLabel modifies the "path" label to the specified file label

-func SetFileLabel(path string, fileLabel string) error {

-	if selinux.SelinuxEnabled() && fileLabel != "" {

-		return selinux.Setfilecon(path, fileLabel)

-	}

-	return nil

-}

-

-// SetFileCreateLabel tells the kernel the label for all files to be created

-func SetFileCreateLabel(fileLabel string) error {

-	if selinux.SelinuxEnabled() {

-		return selinux.Setfscreatecon(fileLabel)

-	}

-	return nil

-}

-

-// Relabel changes the label of path to the filelabel string.

-// It changes the MCS label to s0 if shared is true.

-// This will allow all containers to share the content.

-func Relabel(path string, fileLabel string, shared bool) error {

-	if !selinux.SelinuxEnabled() {

-		return nil

-	}

-

-	if fileLabel == "" {

-		return nil

-	}

-

-	exclude_paths := map[string]bool{"/": true, "/usr": true, "/etc": true}

-	if exclude_paths[path] {

-		return fmt.Errorf("SELinux relabeling of %s is not allowed", path)

-	}

-

-	if shared {

-		c := selinux.NewContext(fileLabel)

-		c["level"] = "s0"

-		fileLabel = c.Get()

-	}

-	if err := selinux.Chcon(path, fileLabel, true); err != nil {

-		return err

-	}

-	return nil

-}

-

-// GetPidLabel will return the label of the process running with the specified pid

-func GetPidLabel(pid int) (string, error) {

-	return selinux.Getpidcon(pid)

-}

-

-// Init initialises the labeling system

-func Init() {

-	selinux.SelinuxEnabled()

-}

-

-// ReserveLabel will record the fact that the MCS label has already been used.

-// This will prevent InitLabels from using the MCS label in a newly created

-// container

-func ReserveLabel(label string) error {

-	selinux.ReserveLabel(label)

-	return nil

-}

-

-// UnreserveLabel will remove the reservation of the MCS label.

-// This will allow InitLabels to use the MCS label in a newly created

-// containers

-func UnreserveLabel(label string) error {

-	selinux.FreeLxcContexts(label)

-	return nil

-}

-

-// DupSecOpt takes an process label and returns security options that

-// can be used to set duplicate labels on future container processes

-func DupSecOpt(src string) []string {

-	return selinux.DupSecOpt(src)

-}

-

-// DisableSecOpt returns a security opt that can disable labeling

-// support for future container processes

-func DisableSecOpt() []string {

-	return selinux.DisableSecOpt()

-}

-

-// Validate checks that the label does not include unexpected options

-func Validate(label string) error {

-	if strings.Contains(label, "z") && strings.Contains(label, "Z") {

-		return ErrIncompatibleLabel

-	}

-	return nil

-}

-

-// RelabelNeeded checks whether the user requested a relabel

-func RelabelNeeded(label string) bool {

-	return strings.Contains(label, "z") || strings.Contains(label, "Z")

-}

-

-// IsShared checks that the label includes a "shared" mark

-func IsShared(label string) bool {

-	return strings.Contains(label, "z")

-}

deleted file mode 100644

@@ -1,511 +0,0 @@

-// +build linux

-

-package selinux

-

-import (

-	"bufio"

-	"crypto/rand"

-	"encoding/binary"

-	"fmt"

-	"io"

-	"os"

-	"path/filepath"

-	"regexp"

-	"strconv"

-	"strings"

-	"sync"

-	"syscall"

-

-	"github.com/opencontainers/runc/libcontainer/system"

-)

-

-const (

-	Enforcing        = 1

-	Permissive       = 0

-	Disabled         = -1

-	selinuxDir       = "/etc/selinux/"

-	selinuxConfig    = selinuxDir + "config"

-	selinuxTypeTag   = "SELINUXTYPE"

-	selinuxTag       = "SELINUX"

-	selinuxPath      = "/sys/fs/selinux"

-	xattrNameSelinux = "security.selinux"

-	stRdOnly         = 0x01

-)

-

-var (

-	assignRegex           = regexp.MustCompile(`^([^=]+)=(.*)$`)

-	mcsList               = make(map[string]bool)

-	mcsLock               sync.Mutex

-	selinuxfs             = "unknown"

-	selinuxEnabled        = false // Stores whether selinux is currently enabled

-	selinuxEnabledChecked = false // Stores whether selinux enablement has been checked or established yet

-)

-

-type SELinuxContext map[string]string

-

-// SetDisabled disables selinux support for the package

-func SetDisabled() {

-	selinuxEnabled, selinuxEnabledChecked = false, true

-}

-

-// getSelinuxMountPoint returns the path to the mountpoint of an selinuxfs

-// filesystem or an empty string if no mountpoint is found.  Selinuxfs is

-// a proc-like pseudo-filesystem that exposes the selinux policy API to

-// processes.  The existence of an selinuxfs mount is used to determine

-// whether selinux is currently enabled or not.

-func getSelinuxMountPoint() string {

-	if selinuxfs != "unknown" {

-		return selinuxfs

-	}

-	selinuxfs = ""

-

-	f, err := os.Open("/proc/self/mountinfo")

-	if err != nil {

-		return selinuxfs

-	}

-	defer f.Close()

-

-	scanner := bufio.NewScanner(f)

-	for scanner.Scan() {

-		txt := scanner.Text()

-		// Safe as mountinfo encodes mountpoints with spaces as \040.

-		sepIdx := strings.Index(txt, " - ")

-		if sepIdx == -1 {

-			continue

-		}

-		if !strings.Contains(txt[sepIdx:], "selinuxfs") {

-			continue

-		}

-		fields := strings.Split(txt, " ")

-		if len(fields) < 5 {

-			continue

-		}

-		selinuxfs = fields[4]

-		break

-	}

-

-	if selinuxfs != "" {

-		var buf syscall.Statfs_t

-		syscall.Statfs(selinuxfs, &buf)

-		if (buf.Flags & stRdOnly) == 1 {

-			selinuxfs = ""

-		}

-	}

-	return selinuxfs

-}

-

-// SelinuxEnabled returns whether selinux is currently enabled.

-func SelinuxEnabled() bool {

-	if selinuxEnabledChecked {

-		return selinuxEnabled

-	}

-	selinuxEnabledChecked = true

-	if fs := getSelinuxMountPoint(); fs != "" {

-		if con, _ := Getcon(); con != "kernel" {

-			selinuxEnabled = true

-		}

-	}

-	return selinuxEnabled

-}

-

-func readConfig(target string) (value string) {

-	var (

-		val, key string

-		bufin    *bufio.Reader

-	)

-

-	in, err := os.Open(selinuxConfig)

-	if err != nil {

-		return ""

-	}

-	defer in.Close()

-

-	bufin = bufio.NewReader(in)

-

-	for done := false; !done; {

-		var line string

-		if line, err = bufin.ReadString('\n'); err != nil {

-			if err != io.EOF {

-				return ""

-			}

-			done = true

-		}

-		line = strings.TrimSpace(line)

-		if len(line) == 0 {

-			// Skip blank lines

-			continue

-		}

-		if line[0] == ';' || line[0] == '#' {

-			// Skip comments

-			continue

-		}

-		if groups := assignRegex.FindStringSubmatch(line); groups != nil {

-			key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])

-			if key == target {

-				return strings.Trim(val, "\"")

-			}

-		}

-	}

-	return ""

-}

-

-func getSELinuxPolicyRoot() string {

-	return selinuxDir + readConfig(selinuxTypeTag)

-}

-

-func readCon(name string) (string, error) {

-	var val string

-

-	in, err := os.Open(name)

-	if err != nil {

-		return "", err

-	}

-	defer in.Close()

-

-	_, err = fmt.Fscanf(in, "%s", &val)

-	return val, err

-}

-

-// Setfilecon sets the SELinux label for this path or returns an error.

-func Setfilecon(path string, scon string) error {

-	return system.Lsetxattr(path, xattrNameSelinux, []byte(scon), 0)

-}

-

-// Getfilecon returns the SELinux label for this path or returns an error.

-func Getfilecon(path string) (string, error) {

-	con, err := system.Lgetxattr(path, xattrNameSelinux)

-	if err != nil {

-		return "", err

-	}

-	// Trim the NUL byte at the end of the byte buffer, if present.

-	if len(con) > 0 && con[len(con)-1] == '\x00' {

-		con = con[:len(con)-1]

-	}

-	return string(con), nil

-}

-

-func Setfscreatecon(scon string) error {

-	return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()), scon)

-}

-

-func Getfscreatecon() (string, error) {

-	return readCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()))

-}

-

-// Getcon returns the SELinux label of the current process thread, or an error.

-func Getcon() (string, error) {

-	return readCon(fmt.Sprintf("/proc/self/task/%d/attr/current", syscall.Gettid()))

-}

-

-// Getpidcon returns the SELinux label of the given pid, or an error.

-func Getpidcon(pid int) (string, error) {

-	return readCon(fmt.Sprintf("/proc/%d/attr/current", pid))

-}

-

-func Getexeccon() (string, error) {

-	return readCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()))

-}

-

-func writeCon(name string, val string) error {

-	out, err := os.OpenFile(name, os.O_WRONLY, 0)

-	if err != nil {

-		return err

-	}

-	defer out.Close()

-

-	if val != "" {

-		_, err = out.Write([]byte(val))

-	} else {

-		_, err = out.Write(nil)

-	}

-	return err

-}

-

-func Setexeccon(scon string) error {

-	return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()), scon)

-}

-

-func (c SELinuxContext) Get() string {

-	return fmt.Sprintf("%s:%s:%s:%s", c["user"], c["role"], c["type"], c["level"])

-}

-

-func NewContext(scon string) SELinuxContext {

-	c := make(SELinuxContext)

-

-	if len(scon) != 0 {

-		con := strings.SplitN(scon, ":", 4)

-		c["user"] = con[0]

-		c["role"] = con[1]

-		c["type"] = con[2]

-		c["level"] = con[3]

-	}

-	return c

-}

-

-func ReserveLabel(scon string) {

-	if len(scon) != 0 {

-		con := strings.SplitN(scon, ":", 4)

-		mcsAdd(con[3])

-	}

-}

-

-func selinuxEnforcePath() string {

-	return fmt.Sprintf("%s/enforce", selinuxPath)

-}

-

-func SelinuxGetEnforce() int {

-	var enforce int

-

-	enforceS, err := readCon(selinuxEnforcePath())

-	if err != nil {

-		return -1

-	}

-

-	enforce, err = strconv.Atoi(string(enforceS))

-	if err != nil {

-		return -1

-	}

-	return enforce

-}

-

-func SelinuxSetEnforce(mode int) error {

-	return writeCon(selinuxEnforcePath(), fmt.Sprintf("%d", mode))

-}

-

-func SelinuxGetEnforceMode() int {

-	switch readConfig(selinuxTag) {

-	case "enforcing":

-		return Enforcing

-	case "permissive":

-		return Permissive

-	}

-	return Disabled

-}

-

-func mcsAdd(mcs string) error {

-	mcsLock.Lock()

-	defer mcsLock.Unlock()

-	if mcsList[mcs] {

-		return fmt.Errorf("MCS Label already exists")

-	}

-	mcsList[mcs] = true

-	return nil

-}

-

-func mcsDelete(mcs string) {

-	mcsLock.Lock()

-	mcsList[mcs] = false

-	mcsLock.Unlock()

-}

-

-func IntToMcs(id int, catRange uint32) string {

-	var (

-		SETSIZE = int(catRange)

-		TIER    = SETSIZE

-		ORD     = id

-	)

-

-	if id < 1 || id > 523776 {

-		return ""

-	}

-

-	for ORD > TIER {

-		ORD = ORD - TIER

-		TIER--

-	}

-	TIER = SETSIZE - TIER

-	ORD = ORD + TIER

-	return fmt.Sprintf("s0:c%d,c%d", TIER, ORD)

-}

-

-func uniqMcs(catRange uint32) string {

-	var (

-		n      uint32

-		c1, c2 uint32

-		mcs    string

-	)

-

-	for {

-		binary.Read(rand.Reader, binary.LittleEndian, &n)

-		c1 = n % catRange

-		binary.Read(rand.Reader, binary.LittleEndian, &n)

-		c2 = n % catRange

-		if c1 == c2 {

-			continue

-		} else {

-			if c1 > c2 {

-				t := c1

-				c1 = c2

-				c2 = t

-			}

-		}

-		mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)

-		if err := mcsAdd(mcs); err != nil {

-			continue

-		}

-		break

-	}

-	return mcs

-}

-

-func FreeLxcContexts(scon string) {

-	if len(scon) != 0 {

-		con := strings.SplitN(scon, ":", 4)

-		mcsDelete(con[3])

-	}