inventory[certname]{facts.kernel = 'linux' and facts.selinux = false}
which seems relatively easy. Something facts-specific is also possible but I'd be wary of muddling up the query language model. Currently PQL "keywords" are tightly bound to the keys you get back in the response, and loosening that association might make the language harder for users to grok.