How can I set the correct SELinux / SEAndroid policy for an App?
I think the problem could be the default &quot;unconfined domain&quot; the binary gets executed when no policy is specified.
An attempt I'd try would be to move the sshelper_sshd (I think it's the sshd server?) somewhere on the /system partition (/system/sbin/?)
I think the best and updated document to read to deal with SELinux implementation on Android (SEAndroid) is How-To SU.
Here an extract from Chapter 5.4.4. Android 4.4.3

A good example of the unconfined domain not being all-mighty, is executing files from /data. Starting Android 4.4.3, this will no longer be possible from the unconfined domain (see #74082 and #78801).
The established practise of including binaries and scripts in your APK, extracting them to /data/data/[package]/files/ or placing them in /data/data/[package]/lib/ and executing them from there through a su call will no longer work out-of-the-box. While there are other work-arounds possible (like copying to and executing from rootfs), one solution is switching contexts to a context not in the unconfined domain (like u:r:untrusted_app:s0, the context the rest of your app is likely to run as). You will need to do extensive testing to see if all the calls you want to make still run in the context you choose, though, and you may have to try some different ones to get the capabilities you want.
Note that executing files in /data will still work as expected from your app if you are not trying to run it as root.