2.4. SELinux States and Modes
SELinux can be either in the enabled or disabled state. When disabled, only DAC rules are used. When enabled, SELinux can run in one of the following modes:
- Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules.
- Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode.
Use the
setenforce
utility to change between enforcing and permissive mode. Changes made with setenforce
do not persist across reboots. To change to enforcing mode, as the Linux root user, run the setenforce 1
command. To change to permissive mode, run the setenforce 0
command. Use the getenforce
utility to view the current SELinux mode:
~]# getenforce
Enforcing
~]#setenforce 0
~]#getenforce
Permissive
~]#setenforce 1
~]#getenforce
Enforcing
Persistent states and modes changes are covered in Section 5.4, “Permanent Changes in SELinux States and Modes”.