Description of problem:

This is a sub-BZ of BZ #2091979.
By default /tmp-inst is the root directory for poly-instantiation. Files under this directory have to be labeled with "<<None>>", similarly to regular /tmp.
But it's currently not the case, files get broken label "default_t" when using *restorecon*/*matchpathcon*:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# matchpathcon /tmp-inst/foo
/tmp-inst/foo	system_u:object_r:default_t:s0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

We need the following rule to be added in the policy:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/tmp-inst/.*                                       all files          <<None>>
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

*Additionally*, files in /var/tmp/tmp-inst have to be labeled with "<<None>>" as well. This is the case but because of the inheritance on "/var/tmp", not on "/var/tmp/tmp-inst":
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/var/tmp/.*                                        all files          <<None>>
/var/tmp/tmp-inst                                  directory          system_u:object_r:tmp_t:s0 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

For clarity, I would recommend adding a rule on "/var/tmp/tmp-inst/.*" (which doesn't exist):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/var/tmp/tmp-inst/.*                               all files          <<None>>
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This would make things more clear when administrators want to setup a different path for poly-instantiation than /var/tmp/tmp-inst, which has to be done through creating an equivalency context.

Version-Release number of selected component (if applicable):

selinux-policy-34.1.29-1.el9_0.noarch

How reproducible:

Always

Steps to Reproduce:
1. Enable poly-instantiation for users (in /etc/security/namespace.conf)
2. Start pam_nameservice service to create the directories
3. Log in as a user
4. Check restorecon on the user

  # restorecon -Frnv /tmp-inst

Actual results:

# restorecon -Frnv /tmp-inst
Would relabel /tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_user1/ssh-XXXXZqdMQd from unconfined_u:object_r:default_t:s0 to system_u:object_r:default_t:s0
Would relabel /tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_user1/ssh-XXXXZqdMQd/agent.1024 from unconfined_u:object_r:default_t:s0 to system_u:object_r:default_t:s0

Expected results:

No relabel, stick to "<<None>>"