selinux: implemented remaining selinux functions

[Gekko0114]

This is an experimental create. This PR is for selinux crate written in Rust.
In this PR, most of remaining selinux functions are implemented.

ref: #2718 #2800 #2825

[Gekko0114]

@utam0k @YJDoc2
Could you review this PR? I think most of remaining selinux functions are covered in this PR.
Though there are several remaining functions, I am not sure all of them are necessary.

[utam0k]

I'll still review this PR because the changes are significant. But I've done the first my review.

[Gekko0114]

Hi @utam0k

Thank you so much for your review. I've fixed or replied to your comments.
Could you take a look when you have time?

[Gekko0114]

Hi @utam0k , @YJDoc2
Thanks for your review. I've updated my PR. Could you take a look?

[utam0k]

I'll review it when I have more time to review. But the structure itself seemed very readable 😍

[utam0k]

The structure itself looks good to me +1. May I ask you to add main.rs to show an example of how to use this crate? I was mistaken.

[utam0k]

The structure itself looks good to me +1. May I ask you to add main.rs to show an example of how to use this crate?

[utam0k]

Is this PR ready for re-reviewing?

[Gekko0114]

@utam0k
Yes, I've added main.rs.
Please take a look when you have time :)

[utam0k]

@utam0k Yes, I've added main.rs. Please take a look when you have time :)

Awesome! Does cargo run need root permission, right?

root ➜ /workspaces/youki/experiment/selinux (selinux) $ ls -Z test_file.txt 
unconfined_u:object_r:public_content_t:s1 test_file.txt

[Gekko0114]

Does cargo run need root permission, right?

Ah I hadn't tried this as a root on workspace, but seems you're right (I've tried it just now).

Seems that whether main.rs can be executed successfully depends on development environment.
I wrote this code on my ec2 amazon linux because selinux is enabled.
However, on my ec2 linux env, "set_file_label" is failed because of amazon linux's setting (though I executed it as a root user).

[YJDoc2]

Hey @Gekko0114 , do you think adding a vagrant file (or making changes in existing ones) to enable selinux in the vagrant box would be a good/easy idea? That way we can have a common dev env to write and test these things. As you said depending on how selinux is setup on machine, the main file can succeed or fail, I think it is a good idea to have a standard env to test in. wdyt?

[Gekko0114]

@YJDoc2 @utam0k
Agree, I think it is good preparing vagrant file for selinux.
Though I am not very familiar with vagrant, I can work on it.
I will take that work after completing this PR. wdyt?

[utam0k]

I will take that work after completing this PR. wdyt?

+1

[utam0k]

Thanks!