CONFIG_LSM is a new option which can be used to enable SELinux. Base
Fedora config does that. When disabled at runtime only, SELinux-aware
kernel will refuse setting securit.selinux xattr, breaking multiple
tools, including initramfs generation (cp --preserve=xattr fails).