diff --git a/config/Config-build.in b/config/Config-build.in
index 98c5f1dc5a..b6a4d7e5ec 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -310,27 +310,45 @@ menu "Global build settings"
 	endchoice
 
 	config TARGET_ROOTFS_SECURITY_LABELS
-		bool "Enable rootfs security labels"
+		bool
 		select KERNEL_SQUASHFS_XATTR
 		select KERNEL_EXT4_FS_SECURITY
 		select KERNEL_F2FS_FS_SECURITY
 		select KERNEL_UBIFS_FS_SECURITY
 		select KERNEL_JFFS2_FS_SECURITY
+
+	config SELINUX
+		bool "Enable SELinux"
+		select KERNEL_SECURITY_SELINUX
+		select TARGET_ROOTFS_SECURITY_LABELS
+		select PACKAGE_procd-selinux
+		select PACKAGE_busybox-selinux
 		help
-		  This option enables the usage of SELinux labels
+		  This option enables SELinux kernel features, applies security labels
+		  in squashfs rootfs and selects the selinux-variants of busybox and procd.
+
+		  Selecting this option results in about 0.5MiB of additional flash space
+		  usage accounting for increased kernel and rootfs size.
 
 	choice
 		prompt "default SELinux type"
 		depends on TARGET_ROOTFS_SECURITY_LABELS
 		default SELINUXTYPE_dssp
 		help
-		  Choose SELinux policy to be used for build.
+		  Select SELinux policy to be installed and used for applying rootfs labels.
+
 		config SELINUXTYPE_targeted
 			bool "targeted"
 			select PACKAGE_refpolicy
+			help
+			  SELinux Reference Policy (refpolicy)
+
 		config SELINUXTYPE_dssp
 			bool "dssp"
 			select PACKAGE_selinux-policy
+			help
+			  Defensec SELinux Security Policy -- OpenWrt edition
+
 	endchoice
 
 endmenu
diff --git a/config/Config-kernel.in b/config/Config-kernel.in
index 935d8e45f6..6ecf287285 100644
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -932,6 +932,7 @@ config KERNEL_SECURITY_SELINUX
 config KERNEL_SECURITY_SELINUX_BOOTPARAM
 	bool "NSA SELinux boot parameter"
 	depends on KERNEL_SECURITY_SELINUX
+	default y
 
 config KERNEL_SECURITY_SELINUX_DISABLE
 	bool "NSA SELinux runtime disable"
@@ -940,6 +941,7 @@ config KERNEL_SECURITY_SELINUX_DISABLE
 config KERNEL_SECURITY_SELINUX_DEVELOP
 	bool "NSA SELinux Development Support"
 	depends on KERNEL_SECURITY_SELINUX
+	default y
 
 config KERNEL_LSM
 	string