Switch selinux enforcement on

BUG: 28053261
Test: TreeHugger
Change-Id: If31e0f00291aefe785173a59c130052d79261ab5
(cherry picked from commit 82b091057eb290c63f4f4fa4fd374e019e7d4d31)
diff --git a/host/commands/launch/flags.cc b/host/commands/launch/flags.cc
index 94149f8..f6f355e 100644
--- a/host/commands/launch/flags.cc
+++ b/host/commands/launch/flags.cc
@@ -60,7 +60,7 @@
     "The codename of the device's hardware, one of {cutf_ivsh, cutf_cvm}");
 DEFINE_string(guest_security, "selinux",
               "The security module to use in the guest");
-DEFINE_bool(guest_enforce_security, false,
+DEFINE_bool(guest_enforce_security, true,
             "Whether to run in enforcing mode (non permissive). Ignored if "
             "-guest_security is empty.");
 DEFINE_bool(guest_audit_security, true,