Currently we can match a client to a service configuration via 2 parameters: euid and socket, we should also add a configuration option where we define a specific selinux label as an allowable client and then allow only clients running under that label to connect to the socket.
This allows processes running under the same euid but having different labels to still use the same socket and different service configurations.