fix: include role.cil, context file, and semanage in make install

[Amy-Ra-lph]

Summary

• Add blastwall-role.cil to ALL_CIL — without it, semodule -i fails with "Failed to resolve roleattributeset"
• Install contexts/blastwall_u to /etc/selinux/targeted/contexts/users/ — without it, pam_selinux silently falls back to staff_t and no kernel deny scopes are enforced
• Register blastwall_u via semanage user during install — without it, SSSD selinux_child crashes with exit status 1 on login
• Clean up user and context file on make uninstall

Context

Found while deploying Blastwall on a 3-node RHEL 10 Beaker lab for an AI agent confinement PoC. The policy design is excellent — all 7 deny scopes work correctly and survive sudo. These are deployment ordering issues, not design problems.

The silent fallback to staff_t (issue #2) is the most dangerous because there's no error, no log entry — everything appears to work but confinement is absent.

Test plan

• make install succeeds without manual semodule -i blastwall-role.cil
• id -Z after SSH login shows blastwall_u:blastwall_r:blastwall_t:s0 (not staff_t)
• semanage user -l | grep blastwall_u shows the user registered
• ls /etc/selinux/targeted/contexts/users/blastwall_u exists
• make uninstall cleans up user, context file, and all modules
• Fresh install on RHEL 10 with FreeIPA SELinux user map works end-to-end

Tested on RHEL 10.0 (Coughlan), kernel 6.12.0-55.76.1.el10_0.x86_64.

[Amy-Ra-lph]

Good catch on the MCS range — updated to default to s0, matching your approach.

The semanage user range sets the ceiling for what categories blastwall_u can access. The actual range applied at login comes from the IPA SELinux user map string. If the IPA map requests a wider range than semanage allows, SSSD's selinux_child rejects it and login fails.

So the relationship is:

• semanage user -a -R "blastwall_r" -r "s0" → ceiling is s0 (no categories)
• IPA map: blastwall_u:s0 → works, gets s0
• IPA map: blastwall_u:s0-s0:c0.c1023 → fails, exceeds ceiling

Default s0 is the tightest and correct for most deployments. Made it configurable via SELINUX_MCS for deployers who want per-agent MCS category isolation (e.g., agent A gets c0.c100, agent B gets c101.c200):

make install SELINUX_MCS="s0-s0:c0.c1023"

We had used the full range in our PoC because our IPA maps specified it — but that was our config choice, not a requirement.