qemu_process: Release domain seclabel later in qemuProcessStop()
qemu_process: Release domain seclabel later in qemuProcessStop()

Some secdrivers (typically SELinux driver) generate unique
dynamic seclabel for each domain (unless a static one is
requested in domain XML). This is achieved by calling
qemuSecurityGenLabel() from qemuProcessPrepareDomain() which
allocates unique seclabel and stores it in domain def->seclabels.
The counterpart is qemuSecurityReleaseLabel() which releases the
label and removes it from def->seclabels. Problem is, that with
current code the qemuProcessStop() may still want to use the
seclabel after it was released, e.g. when it wants to restore the
label of a disk mirror.

What is happening now, is that in qemuProcessStop() the
qemuSecurityReleaseLabel() is called, which removes the SELinux
seclabel from def->seclabels, yada yada yada and eventually
qemuSecurityRestoreImageLabel() is called. This bubbles down to
virSecuritySELinuxRestoreImageLabelSingle() which find no SELinux
seclabel (using virDomainDefGetSecurityLabelDef()) and this
returns early doing nothing.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1751664
Fixes: 8fa0374c5b8e834fcbdeae674cc6cc9e6bf9019f
Signed-off-by: Michal Privoznik <83d82aaba2eed257f4814b0c239c260c4caaadf0@redhat.com>
Reviewed-by: Daniel P. Berrangé <bb938cf255e055ff3507f2627d214e8e62118fcf@redhat.com>

crobinso/libvirt,olafhering/libvirt,libvirt/libvirt,olafhering/libvirt,crobinso/libvirt,nertpinx/libvirt,crobinso/libvirt,zippy2/libvirt,jfehlig/libvirt,jfehlig/libvirt,zippy2/libvirt,olafhering/libvirt,libvirt/libvirt,zippy2/libvirt,libvirt/libvirt,olafhering/libvirt,crobinso/libvirt,zippy2/libvirt,nertpinx/libvirt,nertpinx/libvirt,jfehlig/libvirt,nertpinx/libvirt,libvirt/libvirt,nertpinx/libvirt,jfehlig/libvirt