Make sure all the kernel secmark patches from http://people.redhat.com/jmorris/selinux/secmark/ are going to make it into the RHEL5 kernel.
all of the kernel patches are in the rawhide kernels. some of the userspace may still be missing (iptables) but I believe karl is looking into those issues.