Make SELinux labels opt-in (--oci-worker-selinux=<BOOL>)

[AkihiroSuda]

Fix #3202

[thaJeztah]

So, the only concern I have is (my dislike of) booleans, especially if their default may change at some point (if so, we probably need to have a new option SELinuxDisabled)

I'm not very good at the SELinux terminology, and not sure which options should be "boolean only", or (may) need further customization down the line, so don't have good suggestions right now.

With the above out of the way, some quick looks at what we have in Moby, which (perhaps) may help verify if the current design "looks right";

1. For docker run, we use --security-opt label=<option> where label=disable means "don't apply labels", but custom labels can be passed.
   • ^^ don't know if that applies to build as well (custom labels), but mostly refering to that to indicate "more than just boolean"
2. For volumes we have the z and Z options to apply SELinux labels; would something similar be needed for mounts used during build? (RUN --mount=....)?
3. For the daemon on the other hand, we also have the --selinux-enabled option (config.EnableSelinuxSupport), which is disabled by default, and that one is a boolean.
   • ^^ This PR seems to (roughly) match that, but (as mentioned) whether that design was "correct" in moby or not should be looked at.

[AkihiroSuda]

Yes, this is analogous to 3.

1. For docker run, we use --security-opt label=<option> where label=disable means "don't apply labels", but custom labels can be passed.

AFAICS this rather means calling s.Process.SelinuxLabel, s.Linux.MountLabel, err = label.InitLabels([]string{"disable"}), while 3 does not touch the labels at all

2. For volumes we have the z and Z options to apply SELinux labels; would something similar be needed for mounts used during build? (RUN --mount=....)?

Maybe yes, but that is out of the scope of this PR.

[thaJeztah]

Could be "enabled" and "disabled"

Suggested change

	SELinux = prefix + "selinux" // "true" or "false"
	SELinux = prefix + "selinux" // SELinux support ("enabled", "disabled")

[AkihiroSuda]

@tonistiigi WDYT?

[tonistiigi]

No strict opinion. Personally would prefer values that work with ParseBool. Or selinux.enabled maybe in that case?

[AkihiroSuda]

Changed to selinux.enabled

[tonistiigi]

@AkihiroSuda Check the gofmt

[AkihiroSuda]

fixed

[thaJeztah]

LGTM

[cpuguy83]

LGTM

I think the issue likely arose when we got rid of the selinux build tag.