echo selinux denials out to the console after a run

* use tag provision, we should always check for selinux denials
* using tags is not ideal here

Change-Id: I20e81f78b3d87c3e11045647fa37dafb98c5b5b1