selinux: add global flag for recovery :/