In the interests of readability, the SELinux patch needs cleaning.  This will almost certainly also be needed if we ever offer this to upstream again.

As an example of what I mean, the push_fscreatecon() function was examined as part of https://bugzilla.redhat.com/show_bug.cgi?id=1309730 and has proven very difficult to reason about in its present form: https://github.com/frozencemetery/krb5_fedora/blob/f1cb770b53923018ec6c35e981d160db219286f9/krb5-1.13-selinux-label.patch#L612-L633