These three one-shot tools operate on alternate roots via --root/--image
but until now created files with host SELinux labels, producing images
that fail to boot or run with enforcing mode because every file carries
the wrong security context.
Create a LabelContext from arg_root at startup and thread it through all
labeling call sites so the target image gets labeled according to its own
policy.
Signed-off-by: Simon de Vlieger <cmdr@supakeen.com>
Simon de Vlieger
d652f6dc44