TestSELinux: use LockOSThread to avoid flakes

The SetFSCreateLabel documentation says the caller should use
runtime.LockOSThread. Indeed, if not used, there is an occasional flake:

> $ go test  -run TestSELinux -count 10000 .
> selinux_linux_test.go:168: SetFSCreateLabel failed write /proc/thread-self/attr/fscreate: permission denied
> selinux_linux_test.go:169: write /proc/thread-self/attr/fscreate: permission denied

Add LockOSThread to fix the flake.

While at it, fix logging to avoid printing the same error twice.

Signed-off-by: Kir Kolyshkin <[email protected]>

Author: kolyshkin

go-selinux/selinux_linux_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"testing"
 )
@@ -136,6 +137,12 @@ func TestSELinux(t *testing.T) {
 		t.Skip("SELinux not enabled, skipping.")
 	}
 
+	// Ensure the thread stays the same for duration of the test.
+	// Otherwise Go runtime can switch this to a different thread,
+	// which results in EACCES in call to SetFSCreateLabel.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
 	var (
 		err            error
 		plabel, flabel string
@@ -165,15 +172,13 @@ func TestSELinux(t *testing.T) {
 	if err == nil {
 		t.Log(FSCreateLabel())
 	} else {
-		t.Log("SetFSCreateLabel failed", err)
-		t.Fatal(err)
+		t.Fatal("SetFSCreateLabel failed:", err)
 	}
 	err = SetFSCreateLabel("")
 	if err == nil {
 		t.Log(FSCreateLabel())
 	} else {
-		t.Log("SetFSCreateLabel failed", err)
-		t.Fatal(err)
+		t.Fatal("SetFSCreateLabel failed:", err)
 	}
 	t.Log(PidLabel(1))
 }