server: don't wipe out the selinux mount label if privileged
server: don't wipe out the selinux mount label if privileged

When running a pod with privileged we just need to set the process
label to the empty string. We don't need to wipe out the mount labels
as those are stil applied to mounts and rootfs even if in privileged
mode.

Fix https://bugzilla.redhat.com/show_bug.cgi?id=1624326

We need this to also match the behavior with docker:

docker run -ti -v $(mktemp -d):/testselinux:Z --security-opt
label=level:s0:c25,c968 fedora ls -ldZ /testselinux
drwx------. 2 27212 27212 system_u:object_r:container_file_t:s0:c25,c968
40 Sep  6 17:13 /testselinux

docker run --privileged -ti -v $(mktemp -d):/testselinux:Z
--security-opt label=level:s0:c25,c968 fedora ls -ldZ /testselinux
drwx------. 2 27212 27212 system_u:object_r:container_file_t:s0:c25,c968
40 Sep  6 17:14 /testselinux

You can see the mount label is still getting applied to privileged
containers.

Signed-off-by: Antonio Murdaca <f9809039ea4850e75dcb8d80b778844aa463358f@redhat.com>

kubernetes-incubator/ocid,nalind/cri-o,kubernetes-incubator/cri-o,kubernetes-incubator/ocid,rhatdan/cri-o,mikebrow/cri-o,kubernetes-incubator/ocid,rhatdan/cri-o,nalind/cri-o,kubernetes-incubator/cri-o,mikebrow/cri-o,rhatdan/cri-o,nalind/cri-o,kubernetes-incubator/cri-o,kubernetes-incubator/cri-o,mikebrow/cri-o,rhatdan/cri-o,mikebrow/cri-o