Enabling selinux by default is more trouble than it's worth, even in permissive mode - breaks docker