Add additional directories to block global relabel.
Add additional directories to block global relabel.

I have a few bug reports where people have relabeled /tmp using

--volume /tmp:/tmp:z

Expanding the /* directories to block relabeling, to help uers from
shooting themselves in the foot.

The directories added can have multiple different labels in them and confined
domains need those labels.  If the user causes a contianer runtime to relabel
the content to container_file_t, then loots of confined domains start breaking.

Signed-off-by: Daniel J Walsh <7800de746fd39599bc46177380ea6aede7e31e16@redhat.com>

opencontainers/selinux