checkout: Add SELinux labeling for checkout, use in deploy

This is a variant of the efforts in https://github.com/ostreedev/ostree/pull/741
Working on `rpm-ostree livefs`, I realized though I needed to just
check out *new* files directly into the live `/etc` (and possibly
delete obsolete files).

The way the current `/etc` merge works is fundamentally different from
that.  So my plan currently is to probably do something like:

 - Compute diff
 - Check out each *new* file individually (as a copy)
 - Optionally delete obsolete files

Also, a few other things become more important - in the current deploy code, we
copy all of the files, then relabel them. But we shouldn't expose to *live*
systems the race conditions of doing that, plus we should only relabel files we
checked out.

By converting the deploy's /etc code to use this, we fix the same TODO item
there around atomically having the label set up as we create files. And further,
if we kill the `/var` relabeling which I think is unnecessary since Anaconda
does it, we could delete large chunks of code there.

In the implementation, there are two types of things: regular files, and
symlinks. For regular files, in the `O_TMPFILE` case, we have the ability to
do *everything* atomically (including SELinux labeling) before linking it into
place. So let's just use that. For symlinks, we use `setfscreatecon()`.

Closes: #797
Approved by: jlebon

src/libostree/ostree-sysroot-deploy.c

@@ -767,6 +767,7 @@ selinux_relabel_var_if_needed (OstreeSysroot                 *sysroot,
 
 static gboolean
 merge_configuration (OstreeSysroot         *sysroot,
+                     OstreeRepo            *repo,
                      OstreeDeployment      *previous_deployment,
                      OstreeDeployment      *deployment,
                      int                    deployment_dfd,
@@ -829,19 +830,15 @@ merge_configuration (OstreeSysroot         *sysroot,
       usretc_exists = TRUE;
       etc_exists = FALSE;
     }
-  
+
   if (usretc_exists)
     {
-      glnx_fd_close int deployment_usr_dfd = -1;
-
-      if (!glnx_opendirat (deployment_dfd, "usr", TRUE, &deployment_usr_dfd, error))
-        goto out;
-
-      /* TODO - set out labels as we copy files */
-      g_assert (!etc_exists);
-      if (!copy_dir_recurse (deployment_usr_dfd, deployment_dfd, "etc",
-                             sysroot->debug_flags, cancellable, error))
-        goto out;
+      /* We need copies of /etc from /usr/etc (so admins can use vi), and if
+       * SELinux is enabled, we need to relabel.
+       */
+      OstreeRepoCheckoutAtOptions etc_co_opts = { .force_copy = TRUE,
+                                                  .subpath = "/usr/etc",
+                                                  .sepolicy_prefix = "/etc"};
 
       /* Here, we initialize SELinux policy from the /usr/etc inside
        * the root - this is before we've finalized the configuration
@@ -849,13 +846,15 @@ merge_configuration (OstreeSysroot         *sysroot,
       sepolicy = ostree_sepolicy_new (deployment_path, cancellable, error);
       if (!sepolicy)
         goto out;
-
       if (ostree_sepolicy_get_name (sepolicy) != NULL)
-        {
-          if (!selinux_relabel_dir (sysroot, sepolicy, deployment_etc_path, "etc",
+        etc_co_opts.sepolicy = sepolicy;
+
+      /* Copy usr/etc → etc */
+      if (!ostree_repo_checkout_at (repo, &etc_co_opts,
+                                    deployment_dfd, "etc",
+                                    ostree_deployment_get_csum (deployment),
                                     cancellable, error))
-            goto out;
-        }
+        goto out;
     }
 
   if (source_etc_path)
@@ -2018,7 +2017,7 @@ ostree_sysroot_deploy_tree (OstreeSysroot     *self,
   ostree_deployment_set_bootconfig (new_deployment, bootconfig);
 
   glnx_unref_object OstreeSePolicy *sepolicy = NULL;
-  if (!merge_configuration (self, merge_deployment, new_deployment,
+  if (!merge_configuration (self, repo, merge_deployment, new_deployment,
                             deployment_dfd,
                             &sepolicy,
                             cancellable, error))