Comment # 1 on bug 1234621 from Thorsten Kukuk

You need to add "security=selinux" to all boot entries, as the default for
Tumbleweed is AppArmor and not SELinux.

selinux=1 or enforcing=1 is not necessary, if you did configure
/etc/selinux/config correct.

And yes, if you did boot the system without SELinux active, you need to relabel
with the next "normal" boot. There is a commandline option (autorelabel) to
tell the system to do a full relabel for this cases.
It is not possible to find out, that you did boot the system with selinux
disabled before.