Older kernels do not support keyring labeling

Ignore setting the kernel keyring label if the
/proc/self/attr/keycreate file does not exists.

runc attempts to set this file on older kernels and is blowing up.

If a system has a /proc/self/attr/keyring and the caller attempts to set
the label to "" and SELinux is disabled, ignore the error.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

VERSION

@@ -1 +1 @@
-1.3.0-dev
+1.2.2

go-selinux/selinux_linux.go

@@ -406,7 +406,14 @@ func SocketLabel() (string, error) {
 // SetKeyLabel takes a process label and tells the kernel to assign the
 // label to the next kernel keyring that gets created
 func SetKeyLabel(label string) error {
-	return writeCon("/proc/self/attr/keycreate", label)
+	err := writeCon("/proc/self/attr/keycreate", label)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if label == "" && os.IsPermission(err) && !GetEnabled() {
+		return nil
+	}
+	return err
 }
 
 // KeyLabel retrieves the current kernel keyring label setting