wrong SELinux context on /var/opt/cni

[dustymabe]

Not sure what the root cause is. This is on a local dev build of 4.18:

[core@cosa-devsh ~]$ rpm-ostree status 
State: idle
Deployments:
● ostree-image-signed:oci-archive:/rhcos-418.94.202409261258-0-ostree.x86_64.ociarchive
                   Digest: sha256:52ad12101ddcedf5409bcf2517c97c421f86296330feaf86bfa40b0978e19317
                  Version: 418.94.202409261258-0 (2024-09-26T13:01:22Z)
[core@cosa-devsh ~]$ sudo restorecon -vnr /var/ /etc/ /usr/ /boot/
Would relabel /var/opt/cni from system_u:object_r:usr_t:s0 to system_u:object_r:var_t:s0
[core@cosa-devsh ~]$ rpm -qf /var/opt/cni 
cri-o-1.31.0-4.rhaos4.18.git12d6e5e.el9.x86_64

[jlebon]

I think we're missing an equivalency rule for /var/opt -> /opt. It's probably not worth trying to fix at this point. This is one of those dirs that in the future will be part of the rootfs proper (i.e. it'd no longer be a symlink to /var/opt). This relates to the opt-usrlocal bit we're carrying in coreos/fedora-coreos-config#3177.