Thanks for the info.
I'm using the SELinux-enabled BusyBox that comes with OmniROM, but it's a little dated (1.22.1 bionic) and lacks some applets.
Alternately, you can compile a static BusyBox under Linux. It works but some things are broken (DNS resolving, uid mapping).
What applets is it missing specifically? Im wondering because adding applets to busybox kinda blows especially on aosp, where busybox is built in much the same way as was kernel inlining is done. I just recently rebuilt busybox with bionic and selinux so while it's fresh in my head I might as well add some useful binaries, I think off the top of my head checkpolicy, dispol, sefcontext, getfilecon, and setfilecon are the most useful in addition to the defaults.
I think most people have difficulty building busybox with selinux on aosp is for a few different reasons, the first being that busybox doesn't give much in the way of useful info on how to add it other than "make sure selinux is installed"
Next most selinux stuff we want to use depends on a a libselinux and libsepol minimum, and aosp doesn't contain a Android.mk for generation of the static versions (though the .bp is very useful). And finally it requires linking of the libs, along with references to the includes and its just a mess. Luckily it's not too bad if you have been building selinux and busybox for awhile.
I think I'm just going to fork osm0sis' busybox and see how it is for ndk and aosp.
I'm bored af rn so might as well.