So far we did not correctly label /usr because it broke certain things
like Docker. With the sysext Docker and new policies we should try
again.
First generate the policy before branching off the base squashfs (which
already misses a lot of things because they the most postprocessing is
done late in finish_image!). Then label /usr and also the sysext
contents in their folder - not in the overlay mount because this would
operate on the whole image.
7eb4d4ecd9