selinux: fix off-by-one in setprocattr