Fix install_t again

[cgwalters]

lsm: Make setenforce 0 fallback require BOOTC_SETENFORCE0_FALLBACK

We shouldn't perform global system mutation without an opt-in.
As painful as it is.

Signed-off-by: Colin Walters [email protected]

---

lsm: Test if we have install_t capability

Hardcoding install_t is a bit ugly; maybe at some point
things change so that spc_t has install_t privileges.

Let's do a runtime check if we can set an invalid label; if
so then we're good.

Signed-off-by: Colin Walters [email protected]

---

lsm: Make a not-nosuid /tmp

This was the thing that was breaking our unconfined_t -> install_t
transition; the host /tmp is nosuid. It simplifies things
here to just make our own, so do that.

Signed-off-by: Colin Walters [email protected]

---

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[cgwalters]

I realized we were silently falling back to setenforce 0 - this was motivated by trying to stop doing that by default.

[cgwalters]

OK finally figured out what broke the install_t thing - it was 1af4932 which then pretty quickly got papered over by 600c64d

So this fix I'm pretty confident in.

[cgwalters]

Another important thing in this change is that instead of trying to just check the security context is install_t even we actually test that it works by setting an unmapped security context. So that's much more robust.

[jeckersb]

LGTM, I didn't know about the /proc/1/root trick, interesting!