New internal API: internal_set_libvirt_selinux_label

This internal API sets two SELinux labels in the handle (the process
label and the image label -- they are closely related).

If using the libvirt attach-method with SELinux and sVirt, then this
will cause the following XML to be added to the appliance definition:

<seclabel type=static model=selinux relabel=yes>
  <label>[LABEL HERE]</label>
  <imagelabel>[IMAGELABEL HERE]</imagelabel>
</seclabel>

It is ignored by other attach-methods.
New internal API: internal_set_libvirt_selinux_norelabel_disks.

If set, this causes <seclabel model=selinux relabel=no> to be added to
the disk element in the libvirt XML.

It has no effect *except* on the libvirt attach method when SELinux
and sVirt is being used.
launch: libvirt: Allow the SELinux label to be set on qcow2 overlay files.

When a disk is opened readonly, the libvirt attach-method privately
creates a qcow2 overlay on top.

This commit lets that overlay get an SELinux label, and sets it to the
imagelabel specified by guestfs_internal_set_libvirt_selinux_label.

The above only applies to the libvirt attach-method.
add-domain: Pass SELinux label from guest to appliance (RHBZ#912499).

When adding a domain (ie. guestfs_add_domain), read the SELinux
<label/> and <imagelabel/> from the guest and use them for the
appliance.  The appliance is statically labelled the same as the
guest, so it is able to read its disks.

However tell libvirt not to try relabelling the disks, to prevent
libvirt from disturbing the existing labels on the disks (in
particular when the libvirt connection is closed, we don't want
libvirt to try to restore some other label on the disks).

Updated with feedback from Matthew Booth.
add-domain: Move 'connect_live' function.

This is just code motion.
lib: Check calls to xmlXPathEvalExpression for nodesetval == NULL.

libxml2 xmlXPathEvalExpression can return an unusual nodeset:

  $1 = {type = XPATH_NODESET, nodesetval = 0x0, boolval = 0, floatval = 0,
    stringval = 0x0, user = 0x0, index = 0, user2 = 0x0, index2 = 0}

Note that the nodeset is non-NULL, but the nodesetval is NULL.

Check every call site and fix those that don't deal with this
correctly.
Version 1.21.16.
FAQ: Add question about running fsck on live filesystems.