selinux policy updates - a question