The check_ext_changes flag was intended to ensure that the policy is rebuilt from the current store content, while minimizing the work in case the module content matches (i.e. at least policy.linked can be assumed to be correct already). On a higher level, the goal was to allow to efficiently rebuild the policy during CoreOS/OSTree update process, where the conflict resolution may leave some policy files unchanged when the user has made any customizations.

However, the testing was focused on the case where a user has a local policy module installed, and failed to check that changing booleans also works correctly with this flag used by OSTree, which it indeed doesn't.

To fix this, we need to change semanage_direct_commit() to set do_write_kernel unconditionally when sh->check_ext_changes is set. Then the step to combine policy.linked with the boolean/other dbs into policy.kern (and update /etc/selinux/.../policy/policy.XX) will be always taken and the policy correctly refreshed. This will also change the semantics slightly and the --rebuild-if-modules-changed semodule's switch name will no longer fit, so renaming of it will also be in order (keeping the old name for a while as an alias for compatibility).

To reproduce (assumes fix for BZ 2057497 is in place):
1. Install RHCOS/Fedora CoreOS.
2. Change some boolean using setsebool -P.
3. Update some SELinux policy package (e.g. selinux-policy or container-selinux) and reboot.
4. Check the policy that is loaded and in /etc/selinux/.../policy - both will be the same as before the update.

Expected behavior is that after the update the binary policy contains both the user's boolean tweaks and the updated policy module content from the new packages.

(I'm assigning this to myself to fix it upstream, then I'll switch back to default assignee once the fix is available to do the actual backport.)