dpkg: Do not error out when failing to open the SE label db on permissive mode

If we are running in permissive mode (non-enforced) we should not
consider SE Linux issues as errors.

Closes: #811037

debian/changelog

@@ -44,6 +44,8 @@ dpkg (1.18.5) UNRELEASED; urgency=medium
     - Use it with dpkg --recursive option.
   * Unify start-stop-daemon --help output with the rest of the tools.
   * Search for debsig-verify in PATH instead of using an absolute path.
+  * Do not error out when failing to open the SE label db on permissive mode.
+    Closes: #811037
   * Portability:
     - Move DPKG_ADMINDIR environment variable name out from update-alternatives
       code, to make life easier for non-dpkg-based systems.

src/selinux.c

@@ -76,7 +76,7 @@ dpkg_selabel_load(void)
 	}
 
 	sehandle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
-	if (sehandle == NULL)
+	if (sehandle == NULL && security_getenforce() == 1)
 		ohshite(_("cannot get security labeling handle"));
 #endif
 }