Description of problem:
Enable openshift use system container during ocp-3.9 setup on AH-7.4.5, but node service failed to get started.

RUNNING HANDLER [openshift_node : restart node] ********************************
Sunday 11 February 2018  01:43:55 +0000 (0:00:00.043)       0:11:48.425 ******* 
FAILED - RETRYING: restart node (3 retries left).
FAILED - RETRYING: restart node (2 retries left).
FAILED - RETRYING: restart node (1 retries left).
fatal: [qe-gpei-trymaster-etcd-1.0211-x0e.qe.rhcloud.com]: FAILED! => {"attempts": 3, "changed": false, "msg": "Unable to restart service atomic-openshift-node: Job for atomic-openshift-node.service failed because the control process exited with error code. See \"systemctl status atomic-openshift-node.service\" and \"journalctl -xe\" for details.\n"}



Version-Release number of the following components:
openshift-ansible-3.9.0-0.42.0.git.0.1a9a61b.el7.noarch.rpm
ansible 2.4.2.0-2.el7

[root@qe-gpei-trymaster-etcd-1 ~]# atomic host status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
                   Version: 7.4.5 (2018-02-06 20:55:50)
                    Commit: 04dc7e9e44994fe9d6c512128d417dc823dd28a8dac166af0990875a1c8a5e22
              GPGSignature: Valid signature by 567E347AD0044ADE55BA8A5F199E2F91FD431D51

[root@qe-gpei-trymaster-etcd-1 ~]# atomic images list |grep node
>  registry.reg-aws.openshift.com:443/openshift3/node   v3.9.0   24b61772d34c   2018-02-11 01:42   370.3 MB       ostree


How reproducible:
Always

Steps to Reproduce:
1.Set the following options to enable system container
openshift_use_system_containers=true
system_images_registry=x.x.x.x:443


Actual results:
[root@qe-gpei-trymaster-etcd-1 ~]# journalctl  -f -u  atomic-openshift-node.service
-- Logs begin at Sun 2018-02-11 01:28:47 UTC. --
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 atomic-openshift-node[24704]: I0211 01:49:33.861400   24714 iptables.go:101] Syncing openshift iptables rules
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 atomic-openshift-node[24704]: I0211 01:49:33.861433   24714 iptables.go:419] running iptables -N [OPENSHIFT-FIREWALL-FORWARD -t filter]
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 atomic-openshift-node[24704]: I0211 01:49:33.862102   24714 iptables.go:99] syncIPTableRules took 699.298µs
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 atomic-openshift-node[24704]: F0211 01:49:33.862122   24714 network.go:46] SDN node startup failed: failed to set up iptables: failed to ensure chain OPENSHIFT-FIREWALL-FORWARD exists: error creating chain "OPENSHIFT-FIREWALL-FORWARD": exit status 127: iptables: error while loading shared libraries: libip4tc.so.0: cannot open shared object file: Permission denied
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 systemd[1]: atomic-openshift-node.service: main process exited, code=exited, status=255/n/a
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 atomic-openshift-node[24741]: container "atomic-openshift-node" does not exist
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 systemd[1]: atomic-openshift-node.service: control process exited, code=exited status=1
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 systemd[1]: Failed to start atomic-openshift-node.service.
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 systemd[1]: Unit atomic-openshift-node.service entered failed state.
Feb 11 01:49:33 qe-gpei-trymaster-etcd-1 systemd[1]: atomic-openshift-node.service failed.

After set SELinux to Permissive, node service could be started.
[root@qe-gpei-trymaster-etcd-1 ~]# getenforce
Enforcing
[root@qe-gpei-trymaster-etcd-1 ~]# setenforce 0
[root@qe-gpei-trymaster-etcd-1 ~]# systemctl status atomic-openshift-node.service
● atomic-openshift-node.service
   Loaded: loaded (/etc/systemd/system/atomic-openshift-node.service; enabled; vendor preset: disabled)
   Active: active (running) since Sun 2018-02-11 02:45:01 UTC; 54s ago


Expected results:

Additional info:
Please attach logs from ansible-playbook with the -vvv flag