DisableSecOpt returns a security opt that can disable labeling support for future container processes.

DupSecOpt takes a process label and returns security options that can be used to set duplicate labels on future container processes.

InitLabels returns the process label and file labels to be used within the container.

IsShared checks that the label includes a "shared" mark.

RelabelNeeded checks whether the user requested a relabel.

Validate checks that the label does not include unexpected options.