canonicalisePathMetaData(): Ignore security.selinux attribute

Untested, hopefully fixes #1406.

(cherry picked from commit 88b291ffc4)

src/libstore/local-store.cc

@@ -592,9 +592,13 @@ static void canonicalisePathMetaData_(const Path & path, uid_t fromUid, InodesSe
         if ((eaSize = llistxattr(path.c_str(), eaBuf.data(), eaBuf.size())) < 0)
             throw SysError(format("querying extended attributes of ‘%s’") % path);
 
-        for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1)))
+        for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) {
+            /* Ignore SELinux security labels since these cannot be
+               removed even by root. */
+            if (eaName == "security.selinux") continue;
             if (lremovexattr(path.c_str(), eaName.c_str()) == -1)
                 throw SysError(format("removing extended attribute ‘%s’ from ‘%s’") % eaName % path);
+        }
     }
 #endif