selinux: prevent rentry into the FS