selinux: verify that writes to /proc/... are on procfs
selinux: verify that writes to /proc/... are on procfs

This is an additional mitigation for CVE-2019-16884. The primary problem
is that Docker can be coerced into bind-mounting a file system on top of
/proc (resulting in label-related writes to /proc no longer happening).

While runc is working on mitigations against permitting the mounts, this
helps avoid go-selinux from being tricked into writing to non-procfs
files. This is not a perfect solution (after all, there might be a
bind-mount of a different procfs file over the target) but in order to
exploit that you would need to be able to tweak a config.json pretty
specifically (which thankfully Docker doesn't allow).

Signed-off-by: Aleksa Sarai <b305c9b0212d6145eea67bbffd24e29cb79c759c@cyphar.com>

opencontainers/selinux