If their "reset password" implementation took care to not mess up the MAC labels on edited files, disabling SELinux wouldn't be necessary.

See virt-rescue(1) (and libguestfs-tools in general) for how to do it properly.