Update RPM postinstall.sh script to use restorecon in place of chcon

[atc0005]

Overview

Add support for setting valid SELinux label/contexts/policy for plugins provided by this project (just one as of this writing). There is a rudimentary support already in place for setting a context via chcon, but as discussed elsewhere those values will be lost if the filesystem is relabeled.

This GH issue is intended to track valid or "proper" SELinux values, whether that's via a policy or some other well established pattern.

I should review monitoring plugin packages available via EPEL and similar projects to see how they're handling this.

References

Prior/Related work:

• https://github.com/atc0005/check-cert/issues/439
• https://github.com/atc0005/check-cert/issues/477
• https://github.com/atc0005/check-cert/issues/509
• https://github.com/atc0005/check-cert/issues/533

Additional reading:

• https://unix.stackexchange.com/questions/469134/what-is-the-proper-way-to-set-selinux-context-in-an-rpm-spec-rhel7-in-2018
• https://mgrepl.fedorapeople.org/Blog/nagios.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1813458
• https://bugzilla.redhat.com/show_bug.cgi?id=539707
• http://nuxref.com/2016/11/20/nagios-core-setup-centos-7/
• https://fportase.wordpress.com/selinux-policies/nagios-and-rhel-5-xx-and-6-xx-working-with-selinux-enabled/
• https://github.com/stdevel/check_repodata

[atc0005]

Modified example from https://github.com/stdevel/check_repodata:

$ sudo mv check_repodata.py /usr/lib64/nagios/plugins/check_repodata
$ sudo restorecon -v /usr/lib64/nagios/plugins/check_repodata
restorecon reset /usr/lib64/nagios/plugins/check_repodata context unconfined_u:object_r:lib_t:s0->unconfined_u:object_r:nagios_unconfined_plugin_exec_t:s0