2.4. SELinux States and Modes
SELinux can be either in the enabled or disabled state. When disabled, only DAC rules are used. When enabled, SELinux can run in one of the following modes:
- Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules.
- Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode.
Use the
setenforce utility to change between enforcing and permissive mode. Changes made with setenforce do not persist across reboots. To change to enforcing mode, as the Linux root user, run the setenforce 1 command. To change to permissive mode, run the setenforce 0 command. Use the getenforce utility to view the current SELinux mode:
~]# getenforce
Enforcing~]#setenforce 0~]#getenforcePermissive
~]#setenforce 1~]#getenforceEnforcing
Persistent states and modes changes are covered in Section 5.4, “Permanent Changes in SELinux States and Modes”.
