selinux: introduce domain transitioned kmod helper

This commit uses the previously defined selinux label to transition
from the openvswitch_t to openvswitch_load_module_t domain by
executing ovs-kmod-ctl that is labelled with
openvswitch_load_module_exec_t type.

Note that unless the selinux relabel operation is invoked, the script
will not be labelled.  This merely instructs the selinux tools that
ovs-kmod-ctl should have a label applied.

Acked-by: Ansis Atteka <aatteka@ovn.org>
Acked-by: Timothy Redaelli <tredaelli@redhat.com>
Signed-off-by: Aaron Conole <aconole@redhat.com>

Author: apconole

selinux/.gitignore

@@ -1 +1,5 @@
 openvswitch-custom.te
+openvswitch-custom.fc
+openvswitch-custom.pp
+openvswitch-custom.if
+tmp/

selinux/automake.mk

@@ -6,11 +6,12 @@
 # without warranty of any kind.
 
 EXTRA_DIST += \
+        selinux/openvswitch-custom.fc.in \
         selinux/openvswitch-custom.te.in
 
 PHONY: selinux-policy
 
-selinux-policy: selinux/openvswitch-custom.te
+selinux-policy: selinux/openvswitch-custom.te selinux/openvswitch-custom.fc
 	$(MAKE) -C selinux/ -f /usr/share/selinux/devel/Makefile
 
 CLEANFILES += \

selinux/openvswitch-custom.fc.in

@@ -0,0 +1 @@
+@pkgdatadir@/scripts/ovs-kmod-ctl -- gen_context(system_u:object_r:openvswitch_load_module_exec_t,s0)