selinux: propagate error codes in cond_read_list()