selinux: return proper error codes instead of -1

This is a janitor patch to fix some error codes in selinux. -1 is -EPERM and it's not a good default error code to return. Also there was one place which translated the -1 returns into -EINVAL and that is sort of messy.

This probably doesn't affect anyone. I was just reading the code and decided to fix it. This is for the next merge window obviously.

regards,
dan carpenter