Just to clarify.
I had disabled selinux but that isn't needed. There's an updated
selinux-policy package in updates-testing that takes care of that.
For some reason it apparently didn't work at first for me but I must
have done something wrong (like using setenforce=0 the first reboot
after the update).
And if we disable selinux, relabelling takes quite a long time when we
enable it again.