From dd89eb9eca1ad94f3e4f3a16cc2f5d8396f2ce7b Mon Sep 17 00:00:00 2001
From: Dan Walsh <dwalsh@redhat.com>
Date: Thu, 20 Nov 2014 17:26:43 -0500
Subject: [PATCH] Add call to label to allow it to tell kernel how to label
 created files

SELinux supports a call that tells the kernel, from this point onward
create content with this label.  If you pass "", the kernel will
go back to the default.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
---
 label/label.go         | 4 ++++
 label/label_selinux.go | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/label/label.go b/label/label.go
index 04a72aeae..5a540fd5a 100644
--- a/label/label.go
+++ b/label/label.go
@@ -25,6 +25,10 @@ func SetFileLabel(path string, fileLabel string) error {
 	return nil
 }
 
+func SetFileCreateLabel(fileLabel string) error {
+	return nil
+}
+
 func Relabel(path string, fileLabel string, relabel string) error {
 	return nil
 }
diff --git a/label/label_selinux.go b/label/label_selinux.go
index 0b7d437f8..5983031ae 100644
--- a/label/label_selinux.go
+++ b/label/label_selinux.go
@@ -87,6 +87,14 @@ func SetFileLabel(path string, fileLabel string) error {
 	return nil
 }
 
+// Tell the kernel the label for all files to be created
+func SetFileCreateLabel(fileLabel string) error {
+	if selinux.SelinuxEnabled() {
+		return selinux.Setfscreatecon(fileLabel)
+	}
+	return nil
+}
+
 // Change the label of path to the filelabel string.  If the relabel string
 // is "z", relabel will change the MCS label to s0.  This will allow all
 // containers to share the content.  If the relabel string is a "Z" then