Description of problem:

I'm trying to pass an fd to a dir labeled container_file_t from the rpm-ostree client to the daemon through D-Bus. SELinux blocks it with:

```
Feb 04 19:31:47 localhost.localdomain kernel: type=1400 audit(1549308707.590:9): avc:  denied  { read } for  pid=2973 comm="dbus-daemon" path="/var/lib/containers/storage/overlay/da27c1f519762f83fcf0d0dee24286e047957c5f12a67d436be7e6e4c2674289/merged/srv/repo" dev="overlay" ino=43458 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0:c333,c948 tclass=dir permissive=0
```

This works in f29 at least.

Version-Release number of selected component (if applicable):

```
[root@localhost ~]# rpm-ostree status
State: idle
AutomaticUpdates: disabled
Deployments:
● pivot://registry.svc.ci.openshift.org/rhcos/maipo@sha256:4cf4a15b0232d972d258d852cdb703c8cd75123afb1164c4377890a05f9f95b7
              CustomOrigin: Provisioned from oscontainer
                   Version: 47.301 (2019-02-04T12:48:34Z)
                  Unlocked: development
[root@localhost ~]# rpm -q container-selinux selinux-policy{,-targeted}
container-selinux-2.77-1.el7_6.noarch
selinux-policy-3.13.1-229.el7_6.9.noarch
selinux-policy-targeted-3.13.1-229.el7_6.9.noarch
```

How reproducible:

Always

Steps to Reproduce:
1. podman mount <cnt>
2. build rpm-ostree with https://github.com/projectatomic/rpm-ostree/pull/1732.
2. rpm-ostree rebase /path/to/container/mount:<checksum>

Actual results:

SELinux violation above.

Expected results:

No SELinux violation.

Additional info:

The context for this is https://github.com/projectatomic/rpm-ostree/pull/1732. For RHCOS, we're shipping OS content through a container, and it'd be nice if the client could directly pass the fd rather than having the daemon open the directory itself.

Note on f29 and el8 at least, I see:

```
# sesearch -A -t container_file_t | grep dbus
allow system_dbusd_t container_file_t:dir { getattr ioctl lock open read search };
...
```

So it seems like this was fixed in later versions.