pam_selinux calls setexeccon() with the context of the user, that means that the first execve() after the call to "pam_selinux open" will be executed in the user's context. As pam_motd in debian calls system() to run run-parts to generate the motd dynamically we need to be sure that this is done before that so it runs in the context of the login executable.
A testsuite is also available. Instruction on how to run this testsuite are available in tests/README -- Balint Reczey <rbalint@ubuntu.com>, Sat, 12 Aug 2017 18:46:44 -0400