systemd: earlier smack label switch