drop Docker patch for privileged and SELinux

[bcressey]

Issue number:
Follow-up to #1013

Description of changes:
This removes a patch that's no longer needed on newer versions of Docker, which vendor go-selinux after v1.0.0 and include the fix from opencontainers/selinux@fd7b61c. That ensures that root filesystems of privileged containers still end up with a writable mount label.

Testing done:
Built the aws-dev variant and exercised the cases from #1011.

Privileged:

docker run -it --privileged amazonlinux:2 bash

bash-4.2# touch test
bash-4.2# head -n1 /proc/mounts
overlay / overlay rw,context="system_u:object_r:local_t:s0:c159,c466",...
bash-4.2# cat /proc/self/attr/current
system_u:system_r:container_t:s0

Label disabled:

docker run -it --security-opt label:disable amazonlinux:2 bash

bash-4.2# touch test
bash-4.2# head -n1 /proc/mounts
overlay / overlay rw,context="system_u:object_r:local_t:s0:c12,c282",...
bash-4.2# cat /proc/self/attr/current
system_u:system_r:container_t:s0

Normal:

docker run -it amazonlinux:2 bash

bash-4.2# touch test
bash-4.2# head -n1 /proc/mounts
overlay / overlay rw,context="system_u:object_r:local_t:s0:c17,c466",...
bash-4.2# cat /proc/self/attr/current
system_u:system_r:container_t:s0:c17,c466

Note that the system_u:system_r:container_t:s0 label assigned to the "privileged" and "label disabled" containers are in theory less privileged than a label like system_u:system_r:container_t:s0:c17,c466.

This isn't a problem yet since we don't enforce MCS separation, but will need to be corrected separately by adjusting the SELinux policy.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[samuelkarp]

This patch is no longer needed after #1264?

[bcressey]

This patch is no longer needed after #1264?

It wasn't needed after #1025 but we didn't realize it at the time, since it had just been added in #1013.