tree 3df7fc55ca41b78616c8ee1568106b8feea26015
parent 147ec3be2e7fe5d35553401990317cf49088ec86
author Sebastiaan van Stijn <github@gone.nl> 1509461591 +0100
committer Sebastiaan van Stijn <github@gone.nl> 1509465256 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJZ+Jy5AAoJEHZpjznVJ86MlggQAI7KRHJfwiF9YiOm+0rYWM+G
 PHozoJnvQL9DuKs90I8SnifyyO2sTgE+0LxleTvO7bGaH71h0hDaK1pCd7GPIxrl
 OmOqvL/Xfzye0QX0LNqLYGaQO6x74+nQ/M32zm/rv0i5/TSFTLdHzPHSoxERcKom
 mej+0H4KTcaJM2NUkV3TtaSw4Y/GkxkF5iRH74yyOBIJhqOS5tFa4o1AxMGicJXh
 SqTYco04CdExdYvTFUFgrGh+cLJDhtAoWcZ0uMxymCWs5RH7/DzAwP2vu9vZrILm
 NGdpVEhSG96h8L+MuQUMebCUEKIYtXDMJ4FKupAZzLhHi0oPR+EsqW4zpPsPSuij
 wyCrMa6ZiZi1L3hBIEW9VRNPxIBYlUSnq6P8DaC5zTfth3bQA7fakoXD8W+eMBEe
 2lvbzCvM5PaSLlwW/fHIiwFY6+xBYdxAWEb+XcDAKTmgXIPpOHvmfQSRpv1LqRIP
 8+sJDBR0arJDLa/ZW651nnGZzt5My8TMZHD/VTyPXJjJh19nfkwg2CrWqX5q8g19
 Kl/U1QJcBNHeZM6DLx9QWcCm620w/2qklzR9fdR8wsJLxjgXlcvL4oyhtm8Aq7su
 zcfGATuJnaG2DDvisvSBmr0HQJbepOuX+vhHw4NsEOfowhFv8WU6l/i7+93paS5m
 p0ppZ35N0WwOar7bRjXa
 =lTRr
 -----END PGP SIGNATURE-----

bump opencontainers/selinux to b29023b86e4a69d1b46b7e7b4e2b6fda03f0b9cd

This vendoring fixes two issues.

1. When a user specifies an SELinux MCS Label (level) to override moby picking
   an unigue MCS label, the code currently picks a label then overrides with the
   user selected. This works fine, except the unique MCS Label is leaked and will
   not be used until the daemon is restarted.
2. The override label, is not reserved. This could potentially cause an issue
   where the daemon could pick the same MCS Label again for a different container.
   (~ 1/500,000 Chance).

The updated selinux go bindings, now release the overriden unigue label, and reserve
the one specified by the user.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>