My custom selinux rules (before upstreaming them)