Allow relabeling of files/directories under /usr prefix

[rhatdan]

We already check to make sure users do not accidentily relabel these excluded paths:

exclude_paths := map[string]bool{
	"/":           true,
	"/bin":        true,
	"/boot":       true,
	"/dev":        true,
	"/etc":        true,
	"/etc/passwd": true,
	"/etc/pki":    true,
	"/etc/shadow": true,
	"/home":       true,
	"/lib":        true,
	"/lib64":      true,
	"/media":      true,
	"/opt":        true,
	"/proc":       true,
	"/root":       true,
	"/run":        true,
	"/sbin":       true,
	"/srv":        true,
	"/sys":        true,
	"/tmp":        true,
	"/usr":        true,
	"/var":        true,
	"/var/lib":    true,
	"/var/log":    true,
}

But some users put homedirectories under /usr, and I see no reason to block them from relabeling.

At a certain point if users do something dumb with relableing we can not stop them.

Signed-off-by: Daniel J Walsh dwalsh@redhat.com

[rhatdan]

@kolyshkin @thaJeztah @vrothberg @giuseppe @mrunalp PTAL

[rhatdan]

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2124430

[giuseppe]

LGTM

[vrothberg]

LGTM

[thaJeztah]

We already check to make sure users do not accidentily relabel these excluded paths

Double-checking; it looks like exclude_paths is only used by label.Relabel(); selinux.Chcon() is not checking for any of these; should it ?

[rhatdan]

We could move it into that function instead of label.Relabel. Where we use this in Podman and Buildah is always throught lable.Relabel.