Disable SELinux for profile and workloads

In order for qubesome to work in environments where SELinux
is enabled and enforced the container execution needs to opt-out
from SELinux.

For profiles, it is likely that this will be reverse once we ship
a qubesome-specific SELinux policy. For general workloads that is
less likely.

Signed-off-by: Paulo Gomes <pjbgf@linux.com>

Author: pjbgf

internal/profiles/profiles.go

@@ -557,7 +557,8 @@ func createNewDisplay(bin string, ca, cert, key []byte, profile *types.Profile,
 		"-e", "Q_MTLS_CERT",
 		"-e", "Q_MTLS_KEY",
 		"--device", "/dev/dri",
-		"--security-opt=no-new-privileges:true",
+		"--security-opt=no-new-privileges=true",
+		"--security-opt=label=disable",
 		"--cap-drop=ALL",
 	}
 

internal/runners/docker/run.go

@@ -60,6 +60,7 @@ func Run(ew types.EffectiveWorkload) error {
 		"--rm",
 		"-d",
 		"--security-opt=seccomp=unconfined",
+		"--security-opt=label=disable",
 		"--security-opt=no-new-privileges=true",
 	}
 

internal/runners/podman/run.go

@@ -61,6 +61,7 @@ func Run(ew types.EffectiveWorkload) error {
 		"-d",
 		"--security-opt=seccomp=unconfined",
 		"--security-opt=no-new-privileges=true",
+		"--security-opt=label=disable",
 		"--group-add=keep-groups",
 	}