skip read /proc/filesystems if process_label is null

[ningmingxiao]

when compare to crun runc will open "/proc/filesystems" even process_label is null
when I try to make runc exec faster
#3181

[lifubang]

Good news, thanks. Did you have a benchmark to test how faster than before? For example, you can run 1000 times ’runc exec’.

[ningmingxiao]

Good news, thanks. Did you have a benchmark to test how faster than before? For example, you can run 1000 times ’runc exec’.
runc 1.1.12
old

[root@localhost runc]#  time for ((i=0; i<1000;i++)); do runc exec nmx002 true; done
real    0m46.434s
user    0m9.970s
sys     0m19.874s

after this pr

[root@localhost runc]#  time for ((i=0; i<1000;i++)); do runc exec nmx001 true; done

real    0m44.850s
user    0m9.953s
sys     0m19.343s

will improve little.

[thaJeztah]

Do we know what the intent was for these empty selinux.SetKeyLabel("") ? See my comment on opencontainers/selinux#214 (comment)

[lifubang]

I think it's used to clear the label for the next keyring created by the current process once we got an error when we start/exec the container. Because this label can't be inherited by sub-process, so the initial value should be "", so we can set it to an empty string directly to clear it.

[ningmingxiao]

can we use unix.KeyctlString() set keylabel ? @lifubang

[lifubang]

can we use unix.KeyctlString() set keylabel ?

I think no.