libutil: defer setting the MAC label until after the login classHEADmain

MAC policies, like mac_biba(4), may forbid changing the login class once
a label has been applied.  For setting up the initial login context,
this isn't really expected and in-fact may break some class-based
configuration.

Defer setting the MAC label until after the login class is set, and
remove the requirement that we have a pwd entry since the label is
pulled from the login class -- we only use pwd for syslog in this path.

Patch is largely by Kevin Barry, with some modifications and this commit
message by kevans@.

PR:		177698
Reviewed by:	des, olce
MFC after:	3 days
Co-authored-by:	Kevin Barry <ta0kira gmail com>
Differential Revision:	https://reviews.freebsd.org/D53362

0 files changed, 0 insertions, 0 deletions