Reserve the MCS Level if the caller overrides the default.
Reserve the MCS Level if the caller overrides the default.

If a caller to label.InitLabels specifies a Level, then the library
leaks one Reserved level, and also fails to Reserve the specified level.

This could lead to a potential allocation of a duplicate level which would
eliminate the SELinux separation between two containers.

This patch eliminates the leak and correctly reserves the new level.

Signed-off-by: Daniel J Walsh <7800de746fd39599bc46177380ea6aede7e31e16@redhat.com>

opencontainers/selinux