TestSELinux: use LockOSThread to avoid flakes

The SetFSCreateLabel documentation says the caller should use
runtime.LockOSThread. Indeed, if not used, there is an occasional flake:

> $ go test  -run TestSELinux -count 10000 .
> selinux_linux_test.go:168: SetFSCreateLabel failed write /proc/thread-self/attr/fscreate: permission denied
> selinux_linux_test.go:169: write /proc/thread-self/attr/fscreate: permission denied

Add LockOSThread to fix the flake.

While at it, simplify code flow to avoid using "else", and fix logging
to avoid printing the same error twice.

Signed-off-by: Kir Kolyshkin <[email protected]>

Author: kolyshkin

go-selinux/selinux_linux_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"testing"
@@ -235,6 +236,12 @@ func TestSELinux(t *testing.T) {
 		t.Skip("SELinux not enabled, skipping.")
 	}
 
+	// Ensure the thread stays the same for duration of the test.
+	// Otherwise Go runtime can switch this to a different thread,
+	// which results in EACCES in call to SetFSCreateLabel.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
 	var (
 		err            error
 		plabel, flabel string
@@ -259,21 +266,17 @@ func TestSELinux(t *testing.T) {
 	ReleaseLabel(plabel)
 
 	pid := os.Getpid()
-	t.Logf("PID:%d MCS:%s\n", pid, intToMcs(pid, 1023))
+	t.Logf("PID:%d MCS:%s", pid, intToMcs(pid, 1023))
 	err = SetFSCreateLabel("unconfined_u:unconfined_r:unconfined_t:s0")
-	if err == nil {
-		t.Log(FSCreateLabel())
-	} else {
-		t.Log("SetFSCreateLabel failed", err)
-		t.Fatal(err)
+	if err != nil {
+		t.Fatal("SetFSCreateLabel failed:", err)
 	}
+	t.Log(FSCreateLabel())
 	err = SetFSCreateLabel("")
-	if err == nil {
-		t.Log(FSCreateLabel())
-	} else {
-		t.Log("SetFSCreateLabel failed", err)
-		t.Fatal(err)
+	if err != nil {
+		t.Fatal("SetFSCreateLabel failed:", err)
 	}
+	t.Log(FSCreateLabel())
 	t.Log(PidLabel(1))
 }