Add preliminary selinux rules

The link-generation script still needs fixing, most of everything
else should be g2g