aries: selinux match CM