lsm: treat unlabeled_t SELinux context as unlabeled for relabeling

Cargo.toml

@@ -73,6 +73,7 @@ regex = "1.10.4"
 rustix = { "version" = "1", features = ["use-libc", "thread", "net", "fs", "system", "process", "mount"] }
 serde = "1.0.199"
 serde_json = "1.0.116"
+selinux = "=0.5.0"
 shlex = "2.0"
 similar-asserts = "2.0.0"
 static_assertions = "1.1.0"

contrib/packaging/bootc.spec

@@ -44,6 +44,9 @@ Source1:        %{url}/releases/download/v%{version}/bootc-%{version}-vendor.tar
 ExcludeArch:    %{ix86}
 
 BuildRequires: libzstd-devel
+# selinux-sys generates libselinux bindings with bindgen at build time.
+# bindgen requires libclang.
+BuildRequires: clang-devel
 BuildRequires: make
 BuildRequires: ostree-devel
 BuildRequires: openssl-devel

crates/cli/src/main.rs

@@ -12,7 +12,10 @@ async fn async_main() -> Result<()> {
 
     // As you can see, the role of this file is mostly to just be a shim
     // to call into the code that lives in the internal shared library.
-    bootc_lib::cli::run_from_iter(std::env::args()).await
+    match bootc_lib::cli::run_from_iter(std::env::args()).await? {
+        bootc_lib::cli::CliExitStatus::Success => Ok(()),
+        bootc_lib::cli::CliExitStatus::PredicateFalse => std::process::exit(1),
+    }
 }
 
 /// Perform process global initialization, then create an async runtime

crates/lib/Cargo.toml

@@ -51,6 +51,7 @@ regex = { workspace = true }
 rustix = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+selinux = { workspace = true }
 tempfile = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["io-std", "time", "process", "rt", "net"] }