build: Add --with-smack, use it to reset contexts for writing objects

At some point we'll want to follow what systemd is doing and add
better support for smack, along the lines of `OstreeSePolicy`.  However,
short term this patch fixes AGL which uses Smack.

See: https://jira.automotivelinux.org/browse/SPEC-386
See: https://github.com/ostreedev/ostree/pull/698

Closes: #698
Approved by: OYTIS

src/libostree/ostree-repo-commit.c

@@ -110,6 +110,30 @@ write_file_metadata_to_xattr (int fd,
   return TRUE;
 }
 
+/* See https://github.com/ostreedev/ostree/pull/698 */
+#ifdef WITH_SMACK
+#define XATTR_NAME_SMACK "security.SMACK64"
+#endif
+
+static void
+ot_security_smack_reset_dfd_name (int dfd, const char *name)
+{
+#ifdef WITH_SMACK
+  char buf[PATH_MAX];
+  /* See glnx-xattrs.c */
+  snprintf (buf, sizeof (buf), "/proc/self/fd/%d/%s", dfd, name);
+  (void) lremovexattr (buf, XATTR_NAME_SMACK);
+#endif
+}
+
+static void
+ot_security_smack_reset_fd (int fd)
+{
+#ifdef WITH_SMACK
+  (void) fremovexattr (fd, XATTR_NAME_SMACK);
+#endif
+}
+
 gboolean
 _ostree_repo_commit_loose_final (OstreeRepo        *self,
                                  const char        *checksum,
@@ -221,6 +245,7 @@ commit_loose_object_trusted (OstreeRepo        *self,
 
       if (xattrs != NULL)
         {
+          ot_security_smack_reset_dfd_name (self->tmp_dir_fd, temp_filename);
           if (!glnx_dfd_name_set_all_xattrs (self->tmp_dir_fd, temp_filename,
                                                xattrs, cancellable, error))
             goto out;
@@ -252,6 +277,7 @@ commit_loose_object_trusted (OstreeRepo        *self,
 
           if (xattrs)
             {
+              ot_security_smack_reset_fd (fd);
               if (!glnx_fd_set_all_xattrs (fd, xattrs, cancellable, error))
                 goto out;
             }