Introduce an SELinux kernel API, for use at this stage by iptables
matches and targets.