pub(crate) fn selinux_enabled() -> bool
Whether SELinux is enabled for the current process.
libselinux caches this state process-wide, so mounting selinuxfs requires a re-exec before this result can change.