diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
index 88e0387df9..138ee5a399 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
@@ -2,3 +2,8 @@
 # smartmontools - it is only relevant for smartd daemon, which we do
 # not build.
 sys-apps/smartmontools caps
+
+# Allow USE=python for sys-libs/libselinux - it is needed by portage
+# with USE=selinux. For production images, we will filter python files
+# out with an install mask.
+sys-libs/libselinux -python
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
index dbec72a552..ca019b5934 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
@@ -52,3 +52,5 @@ INSTALL_MASK="${INSTALL_MASK}
   /sbin/ebtables-save
   /sbin/xfs_scrub_all
 "
+
+# TODO: Add libselinux python stuff to install mask here.