correctly check for selinux state (#896610)