diff --git a/selinux-policy.spec b/selinux-policy.spec
index f7b074ac6c664fdcf4ce7f031e422de98213598d..231dbaca98d3e4e596f50de8b254c24f8f070dab 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,3 +1,4 @@
+%define anolis_release .0.1
 # github repo with selinux-policy base sources
 %global git0 https://github.com/fedora-selinux/selinux-policy
 %global commit0 642155b226a48d3edbdc1a13fb9a9fece74140f7
@@ -29,7 +30,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.14.3
-Release: 93%{?dist}
+Release: 93%{anolis_release}%{?dist}
 License: GPLv2+
 Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
 Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz
@@ -458,7 +459,7 @@ echo "
 #     enforcing - SELinux security policy is enforced.
 #     permissive - SELinux prints warnings instead of enforcing.
 #     disabled - No SELinux policy is loaded.
-SELINUX=enforcing
+SELINUX=disabled
 # SELINUXTYPE= can take one of these three values:
 #     targeted - Targeted processes are protected,
 #     minimum - Modification of targeted policy. Only selected processes are protected. 
@@ -717,6 +718,10 @@ exit 0
 %endif
 
 %changelog
+* Sun Apr 24 2022 Weitao Zhou <zhouwt@linux.alibaba.com> - 3.14.3-93.0.1
+- Disable selinux by default
+- cherry-pick [bfc16aa]
+
 * Thu Feb 24 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
 - Allow systemd-networkd dbus chat with sosreport
 Resolves: rhbz#1949493