TestSocketLabel: use LockOSThread to avoid flakes

The SetSocketLabel documentation says the caller should use
runtime.LockOSThread. Indeed, if not used, there is an occasional flake:

> $ go test  -count 10000 -run SocketLabel .
> --- FAIL: TestSocketLabel (0.00s)
>     label_linux_test.go:189: write /proc/thread-self/attr/sockcreate: permission denied

Add LockOSThread to fix the flake.

Signed-off-by: Kir Kolyshkin <[email protected]>

Author: kolyshkin

go-selinux/label/label_linux_test.go

@@ -3,6 +3,7 @@ package label
 import (
 	"errors"
 	"os"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -181,6 +182,12 @@ func TestSELinuxNoLevel(t *testing.T) {
 func TestSocketLabel(t *testing.T) {
 	needSELinux(t)
 
+	// Ensure the thread stays the same for duration of the test.
+	// Otherwise Go runtime can switch this to a different thread,
+	// which results in EACCES in call to SetSocketLabel.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
 	label := "system_u:object_r:container_t:s0:c1,c2"
 	if err := selinux.SetSocketLabel(label); err != nil {
 		t.Fatal(err)