config: prepare for choice of SELinux policy