ws: Add SELinux policy for cockpit-ws to our test environment

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Turn on selinux enforcing in our tests

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Create test images with SELinux enabled and enforcing

We run in enforcing mode when not in maintain mode of running
our VMs

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Pull audit messages and check that not unexpected

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Ignore another journal message

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement a new selinux policy for cockpit-ws and cockpit-session

 * cockpit-ws is the most restricted process
   - listens on the network
   - runs cockpit-session
   - connects to other hosts via ssh
   - reads some files in specific directories
   - not much else
 * cockpit-session is slightly restricted
   - but it runs a full PAM stack
   - transitions to user/group
   - runs cockpit-agent
 * cockpit-agent is totally unconfined
   - runs as the user

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Add selinux unconfined policy for test-server

Fixes #200
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Some cleanup in the selinux type enforce file

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Enable globbing in the INSTALL script.

Because we need it for "rm -rf /var/log/journal/*".  This was broken
all the time but now it bites us because audit messages from
before the relabeling are left in the journal.

Reviewed-by: Stef Walter <stefw@redhat.com>
test: Enable audit journalling in cockpit.setup.

And not in the INSTALL script.  This avoids disturbing other image
flavors.

Reviewed-by: Stef Walter <stefw@redhat.com>
ws: Rely on pam_selinux.so to transition cockpit-agent correctly

Changes from mgrepl@redhat.com
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Cleanup selinux policy further

Use common interfaces instead of defining the policy bit by byt

Signed-off-by: Stef Walter <stefw@redhat.com>
 * userdomain_signal -> userdom_signal_all_users
 * Cleaned up comments
 * added setexec for cockpit_session_t
test: Make selinux permissive in the ipa test image

We really don't want to be chasing around selinux bugs in a
whole different stack ... at least not yet.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Don't check the error message when killing the agent.

It doesn't seem to be predictable any more.
See https://github.com/cockpit-project/cockpit/issues/606