containerd: selinux not working under containerd with selinux-enable=true

Description

I have two k8s cluster, one using docker and another using containerd directly, both with selinux enabled. but I found selinux not actually working on the containerd one, although this two cluster have the same version of containerd and runc.

did i miss some setting with containerd?

Steps to reproduce the issue:

1. enable selinux by setting [enable_selinux = true] in /etc/containerd/config.toml
2. create pod using tomcat official image
3. check the process and file label

Describe the results you received:

# kubectl exec tomcat -it -- ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:spc_t:s0          1 ?        00:00:00 java

# ls -Z /usr/local/openjdk-8/bin/java
system_u:object_r:container_var_lib_t:s0 /usr/local/openjdk-8/bin/java

Describe the results you expected:

# kubectl exec tomcat -it -- ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:container_t:s0:c655,c743          1 ?        00:00:00 java

# ls -Z /usr/local/openjdk-8/bin/java
system_u:object_r:container_file_t:s0:c655,c743 /usr/local/openjdk-8/bin/java

Output of containerd --version:

# containerd -v
containerd  1.2.10 b34a5c8af56e510852c35414db4c1f4fa6172339

Any other relevant information: OS Centos7 rpm repo https://download.docker.com/linux/centos/7/ K8s version: 1.15 Containerd version: 1.2.10