At least, I think SELinux's "make relabel" can't relabel
files that are not in the namespace of "make" process.
I don't know how to use inotify, but what I worried is ...
If there are cases they are in different namespace,
it is impossible to relabel using userland daemon
(i.e. deferred-relabeling won't work)
unless all pathnames of all namespaces are somehow
accessible via inotify.