Bug 2219398

on fedora coreos stable (fedora 38), x86_84 (38.20230609.3.0):

after making a file tree of an os filesystem with mkosi,
i try to use `machinectl import-fs` to copy the directory tree to /var/lib/machines
for usage with systemd-nspawn, but because coreos uses selinux in enforcing mode,
it breaks import-fs in a non obvious way.

The command stalls at the copy operation, without any explanation or obvious error.
(machinectl calls systemd-import-fs with then spawns systemd-importd which gets denied by selinux)

as workaround, simply copying the files with `cp -a` to /var/lib/machines succeeds.


Reproducible: Always

Steps to Reproduce:
# on coreos you have to layer in mkosi and apt
rpm-ostree install --assumeyes --idempotent --allow-inactive mkosi apt

# make dirs for mkosi
mkdir -p /etc/mkosi/debian-bookworm /var/lib/mkosi /var/cache/mkosi

# write a simple config for debian bookworm creation
printf "[Distribution]\nDistribution=debian\nRelease=bookworm\n[Output]Format=directory
[Packages]\n[Host]\n[Validation]" > /etc/mkosi/debian-bookworm/mkosi.conf

# call mkosi to make the file tree
mkosi -C /etc/mkosi/debian-bookworm -O /var/lib/mkosi --cache=/var/cache/mkosi build
mv /var/lib/mkosi/debian~bookworm /var/lib/mkosi/debian-bookworm

# works up to here

# fails: import filetree to nspawn /var/lib/machines
machinectl import-fs /var/lib/mkosi/debian-bookworm hello-nspawn
Actual Results:  
command does not finish, and hangs.

selinux audit log entries:
```
audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 
    subj=system_u:system_r:init_t:s0 msg='unit=systemd-importd comm="systemd" 
    exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
audit: type=1130 audit(1687265080.304:465): pid=1 uid=0 auid=4294967295 ses=4294967295
    subj=system_u:system_r:init_t:s0 msg='unit=systemd-importd comm="systemd" 
    exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
audit[5023]: AVC avc:  denied  { execute } for  pid=5023 comm="(sd-transfer)" 
    name="systemd-import-fs" dev="dm-0" ino=14841116 
    scontext=system_u:system_r:systemd_importd_t:s0 
    tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0
audit[5023]: SYSCALL arch=c000003e syscall=59 success=no exit=-13 a0=5639dc5a36e8
    a1=7ffd102d2350 a2=5639dd7a91f0 a3=7ff68bdf8810 items=0 ppid=5022 pid=5023
    auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
    tty=(none) ses=4294967295 comm="(sd-transfer)" exe="/usr/lib/systemd/systemd-importd"
    subj=system_u:system_r:systemd_importd_t:s0 key=(null)
audit: PROCTITLE proctitle="(sd-transfer)"
    (sd-transfer)[5023]: Failed to execute /usr/lib/systemd/systemd-import-fs 
    tool: Permission denied
```


Expected Results:  
command finished, and has copied files from /var/lib/mkosi/debian-bookworm to /var/lib/machines/hello-nspawn

related binaries selinux information:
```
-rwxr-xr-x. 4 root root system_u:object_r:systemd_importd_exec_t:s0 49824
     Jan  1  1970 /usr/lib/systemd/systemd-importd
-rwxr-xr-x. 4 root root system_u:object_r:init_exec_t:s0 33128 Jan  1  1970
    /usr/lib/systemd/systemd-import-fs
```