cri: warn when a sandbox controller returns an SELinux label

CRI owns the pod SELinux label, so a label returned by the sandbox
controller is ignored. Log a warning when it differs from the one CRI
allocated.

Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>

internal/cri/server/sandbox_run.go

@@ -362,6 +362,15 @@ func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandbox
 		}
 	}
 
+	// CRI owns the pod SELinux label; a label from the controller is ignored.
+	if l := ctrl.Labels["selinux_label"]; l != "" && l != sandbox.ProcessLabel {
+		log.G(ctx).WithFields(log.Fields{
+			"sandbox":          id,
+			"controller_label": l,
+			"selinux_label":    sandbox.ProcessLabel,
+		}).Warn("ignoring the SELinux label returned by the sandbox controller, using the label allocated by CRI")
+	}
+
 	sandboxInfo.Labels = ctrl.Labels
 	sandboxInfo.Spec = ctrl.Spec