- enable selinux by default (following upstream)