diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/generic/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/generic/use.mask
new file mode 100644
index 0000000000..a24662d0ea
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/generic/use.mask
@@ -0,0 +1,2 @@
+# Unmask selinux so it can be enabled selectively in package.use
+-selinux
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 5fefecaa49..d7d483989a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -1,2 +1 @@
 kdbus
--selinux