Merge pull request cri-o#9666 from bitoku/systemd-selinux

openshift-merge-bot[bot] · web-flow · commit 0e42a1f91112 · 2025-12-16T23:47:18.000Z
OCPBUGS-69402: Ensure `InitLabel` only sets process label when unset
diff --git a/server/container_create.go b/server/container_create.go
@@ -1015,9 +1015,14 @@ func (s *Server) setupContainerMountsAndSystemd(ctr container.Container, sb *san
 	if ctr.WillRunSystemd() {
 		var err error
 
-		processLabel, err = InitLabel(processLabel)
-		if err != nil {
-			return "", err
+		// Don't override the process label if it was already set.
+		// Otherwise, it should be set container_init_t to run the init process
+		// in a container.
+		if processLabel == "" {
+			processLabel, err = InitLabel(processLabel)
+			if err != nil {
+				return "", err
+			}
 		}
 
 		setupSystemd(specgen.Mounts(), *specgen)
