selinux: return -ENOMEM when memory allocation fails