Just to clarify. I had disabled selinux but that isn't needed. There's an updated selinux-policy package in updates-testing that takes care of that. For some reason it apparently didn't work at first for me but I must have done something wrong (like using setenforce=0 the first reboot after the update). And if we disable selinux, relabelling takes quite a long time when we enable it again.