install: Label root SSH drop-in by its full path

[andrewdunndev]

The tmpfiles.d drop-in for --root-ssh-authorized-keys is written relative to the /etc/tmpfiles.d directory fd, but atomic_replace_labeled looks up the label for its destination joined onto /, so it expects to be handed the root. The policy is asked about /bootc-root-ssh.conf, which on Fedora and CentOS is etc_runtime_t, so restorecon on the installed system wants to relabel the file to etc_t. The composefs injection in #2536 goes through the same call.

This writes the drop-in as etc/tmpfiles.d/bootc-root-ssh.conf relative to the root, as the fstab and shadow callers already do, and documents on atomic_replace_labeled that it expects the root. test_inject_root_ssh_label checks the injected file's label against the host policy's label for /etc/tmpfiles.d/bootc-root-ssh.conf, and returns early where SELinux reads as disabled, which includes the containerized just unit-tests run.

Testing: make validate passes, and cargo test -p bootc-lib reports 287 passed and 1 ignored. With SELinux enforcing, the new test fails when the call goes back to the tmpfiles.d directory (left: "system_u:object_r:etc_runtime_t:s0", right: "system_u:object_r:etc_t:s0"). In a test VM, installs with --root-ssh-authorized-keys on this version label the drop-in etc_t, and restorecon -n -v finds nothing to relabel. That holds on ostree, and with --composefs-backend when merged with #2536. Main on ostree, and #2536 alone, give etc_runtime_t.

There's no integration assertion: both install tests that pass --root-ssh-authorized-keys, the alongside install in tests-integration and the check #2536 adds, run with SELinux disabled.

Closes: #2538

[cgwalters]

I think the problem here is the atomic_replace_labeled was expecting the passed Dir to be a root - and arguably that's a cleaner fix, change everything using that to pass the root?

[andrewdunndev]

Agreed, that's cleaner. The drop-in was the only caller passing a subdirectory, so it now passes the root like the others, as_path is gone, and the doc comment on atomic_replace_labeled now says it expects the root. That puts this in conflict with #2536 in osconfig.rs, so once either merges I'll rebase the other.

[andrewdunndev]

Rebased onto main after #2536, which gave inject_root_ssh_authorized_keys a separate dest directory for the drop-in. The full-path write now goes against dest, the directory the ensure_dir_labeled call above it already treats as the root, and the new label test passes root as both directories. The ostree path passes the deployment root for both, so it's unchanged from the approved version, and the composefs path now gets the full-path lookup as well.