IPsec: correct semantics for SELinux policy matching