With rpm-ostree, /var/ directory doesn't contain any file, just
directories. It means that SELinux policy can't be managed or rebuilt
and users have to use only the default policy.
This update adds /usr/share/selinux/POLICYTYPE/default directory and
selinux-factory-reset service.
/var/lib/selinux/POLICYTYPE/active
selinux-reset-policy
Petr Lautrbach