smack: never follow symlinks when relabelling

previously mac_smack_apply(path, NULL) would operate on the symlink
itself while mac_smack_apply(path, "foo") would follow the symlink.
Let's clean this up an always operate on the symlink, which appears to
be the safer option.

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
smack: rework SMACK label fixing code to follow more closely the semantics of the matching selinux code

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
selinux: drop 3 unused function prototypes

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
smack: we don't need the special labels exported, hence don't

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
selinux: rework label query APIs

APIs that query and return something cannot silently fail, they must
either return something useful, or an error. Fix that.

Also, properly rollback socket unit fd creation when something goes
wrong with the security framework.

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
selinux: simplify and unify logging

Normally we shouldn#t log from "library" functions, but SELinux is
weird, hence upgrade security messages uniformly to LOG_ERR when in
enforcing mode.

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
selinux: clean up selinux label function naming

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
label: don't try to create labelled directories more than once

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
src/udev/udevd.c: rename apis again in static_dev_create_from_modules()

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>