[backport 1.19] cri: pull in updated /dev/shm fix

[dweomer]

Proposed Changes

Do not relabel container /dev/shm when it is host /dev/shm.

Types of Changes

bugfix

Verification

kubectl run envoy --image=envoyproxy/envoy:v1.14.1
pod/envoy created
# after some seconds, should get a running pod:
kubectl get pod
NAME    READY   STATUS    RESTARTS   AGE
envoy   1/1     Running   0          18s

Additionally, with HostIPC=true:

kubectl run envoy --image=envoyproxy/envoy:v1.14.1 --overrides='{ "apiVersion": "v1", "spec": { "hostIPC" : true} }'
pod/envoy created
# after some seconds, should get a running pod:
kubectl get pod
NAME    READY   STATUS    RESTARTS   AGE
envoy   1/1     Running   0          18s

And a directory listing of /dev/shm should look like:

ls -alZ /dev/shm/
drwxrwxrwt. root root system_u:object_r:tmpfs_t:s0     .
drwxr-xr-x. root root system_u:object_r:device_t:s0    ..
-rw-------. root root system_u:object_r:container_file_t:s0 envoy_shared_memory_0

Specifically, /dev/shm should NOT have the container_file_t context label.

Linked Issues

#2240

Further Comments

cherry-picked from containerd/cri#1605

[galal-hussein]

LGTM