add knob for SELinux support