diff --git a/contrib/rh-bkr/bkr.py b/contrib/rh-bkr/bkr.py
index 31567e62f2..7ae3ffde27 100755
--- a/contrib/rh-bkr/bkr.py
+++ b/contrib/rh-bkr/bkr.py
@@ -477,6 +477,7 @@ class CmdSubmit(CmdBase):
         self.parser.add_argument('--job', '-j', help='beaker xml job file')
         self.parser.add_argument('--verbose', '-v', action='count', help='print more information')
         self.parser.add_argument('--reservesys', '-R', action='store_true', help='add task /distribution/reservesys')
+        self.parser.add_argument('--disable-selinux', action='store_true', help='add kernel option selinux=0 to disable AVC checks ($SELINUX_DISABLED)')
         self.parser.add_argument('--var', '-V', action='append', help='Set template replacements (alternative to setting via environment variables')
         self.parser.add_argument('--hosttype', help='The host type. Known values are \'veth\', \'dcb\', \'infiniband\', and \'wifi\'. Anything else uses the default. This determines the $HOSTREQUIRES template')
         self.parser.add_argument('--jobtype', help='The job type. Known values are \'rhel70\'. Anything else uses the default to create a retention=scratch job. This determines the $JOBTYPE template')
@@ -640,6 +641,14 @@ class CmdSubmit(CmdBase):
             return ""
         return '<reservesys duration="86400"/>'
 
+    def _process_line_get_SELINUX_DISABLED(self, key, replacement, index=None, none=None):
+        v = self._get_default('SELINUX_DISABLED')
+        if v is not None:
+            return v
+        if self.options.disable_selinux:
+            return 'selinux=0'
+        return ''
+
     DefaultReplacements = {
             'WHITEBOARD'        : 'Test NetworkManager',
             'DISTRO_FAMILY'     : 'RedHatEnterpriseLinux7',
@@ -653,6 +662,7 @@ class CmdSubmit(CmdBase):
             'GIT_TARGETBRANCH'  : _process_line_get_GIT_TARGETBRANCH,
             'UUID'              : str(uuid.uuid4()),
             'RESERVESYS'        : _process_line_get_RESERVESYS,
+            'SELINUX_DISABLED'  : _process_line_get_SELINUX_DISABLED,
         }
     def _process_line_get(self, key, replacement, index=None, none=None):
         if key in replacement:
diff --git a/contrib/rh-bkr/job01.xml b/contrib/rh-bkr/job01.xml
index 8bcc99e68e..078165bb10 100644
--- a/contrib/rh-bkr/job01.xml
+++ b/contrib/rh-bkr/job01.xml
@@ -4,7 +4,7 @@
 		$ARGV $ARGV_PROFILE
 	</whiteboard>
 	<recipeSet priority="Normal">
-		<recipe kernel_options="" kernel_options_post="" ks_meta="" role="None" whiteboard="$WHITEBOARD $UUID">
+		<recipe kernel_options="$SELINUX_DISABLED" kernel_options_post="" ks_meta="" role="None" whiteboard="$WHITEBOARD $UUID">
 			<autopick random="true"/>
 			<watchdog panic="None"/>
 			<packages/>