When allocation of labels on files is implicitly disabled due to MAC
policy configuration, avoid leaking resources following failed calls
to get and set MAC labels by file descriptor.

Reported by: Mateusz Guzik <mjguzik at gmail.com> + clang scan-build
MFC after: 3 days