cri: pull in updated /dev/shm fix

[dweomer]

Proposed Changes

Do not relabel container /dev/shm when it is host /dev/shm.

Types of Changes

bugfix

Verification

kubectl run envoy --image=envoyproxy/envoy:v1.14.1
pod/envoy created
# after some seconds, should get a running pod:
kubectl get pod
NAME    READY   STATUS    RESTARTS   AGE
envoy   1/1     Running   0          18s

Additionally, with HostIPC=true:

kubectl run envoy --image=envoyproxy/envoy:v1.14.1 --overrides='{ "apiVersion": "v1", "spec": { "hostIPC" : true} }'
pod/envoy created
# after some seconds, should get a running pod:
kubectl get pod
NAME    READY   STATUS    RESTARTS   AGE
envoy   1/1     Running   0          18s

And a directory listing of /dev/shm should look like:

ls -alZ /dev/shm/
drwxrwxrwt. root root system_u:object_r:tmpfs_t:s0     .
drwxr-xr-x. root root system_u:object_r:device_t:s0    ..
-rw-------. root root system_u:object_r:container_file_t:s0 envoy_shared_memory_0

Specifically, /dev/shm should NOT have the container_file_t context label.

Linked Issues

#2240

Further Comments

cherry-picked from containerd/cri#1605

[galal-hussein]

LGTM

[davidnuzik]

@ShylajaDevadiga to test once it's merged into master. @ShylajaDevadiga I'm not privy to the LOE to test seems small but it can wait until tomorrow morning. If needed, we should just do it first thing tomorrow. There will also be backports fyi to come in later (but I think we are okay with just a check in master unless @dweomer believes otherwise.

[ShylajaDevadiga]

Validated the fix using commit 2c666af on rhel 7.8 as well rhel 8.2
selinux Enforced mode
hostIPC set to true
Updated in issue #2240