Description of problem:
In the Image Builder team, we have a simple tool called 'image-info' [1]. We use it to analyse images produced by our tooling, which is part of the official RHEL release process and used via Brew. We recently extended the tool to check the SELinux context of all files present in the image for any discrepancies. In order to analyse an image, the tool mounts it to a temporary directory on the host system and runs checks against it. For checks, we prefer using binaries from the host. However in order to produce correct report for SELinux, we need to perform the check of the image against the binary policy present on the image. Otherwise the produced report may be incorrect, especially if the image contains any RPMs shipping a custom SELinux policy, which is not present on the host system. However, on RHEL-8, the version of 'setfiles' does not allow this.

The change to allow specifying a different binary policy using '-c' is already present in the upstream and in Fedora. I would like to request that the relevant change is backported to RHEL-8.

[1] https://github.com/osbuild/osbuild-composer/blob/main/tools/image-info

Version-Release number of selected component (if applicable):
policycoreutils-2.9-14.el8.x86_64.rpm

How reproducible:
always

Steps to Reproduce:
1. Download any RHEL image, e.g. the KVM Guest image
2. Mount the image to '<mounted_image_path>'
3. Run 'setfiles -r <mounted_image_path> -nvF -c <mounted_image_path>/etc/selinux/targeted/policy/policy.31 <mounted_image_path>/etc/selinux/targeted/contexts/files/file_contexts <mounted_image_path>'

Actual results:
setfiles prints is usage message:
usage:  setfiles [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file pathname...
usage:  setfiles [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file -f filename
usage:  setfiles -s [-diIDlmnpqvFW] spec_file
usage:  setfiles -c policyfile spec_file

Expected results:
setfiles should use the provided binary policy file and check the provided filesystem root against it.

Additional info:
Relevant upstream commit: https://github.com/SELinuxProject/selinux/commit/c94e542c98da2f26863c1cbd9d7ad9bc5cca6aff