2.4. SELinux States and Modes

SELinux can be either in the enabled or disabled state. When disabled, only DAC rules are used. When enabled, SELinux can run in one of the following modes:

Use the setenforce utility to change between enforcing and permissive mode. Changes made with setenforce do not persist across reboots. To change to enforcing mode, as the Linux root user, run the setenforce 1 command. To change to permissive mode, run the setenforce 0 command. Use the getenforce utility to view the current SELinux mode:

getenforce

~]# getenforce
Enforcing

setenforce 0
getenforce

~]# setenforce 0
~]# getenforce
Permissive

setenforce 1
getenforce

~]# setenforce 1
~]# getenforce
Enforcing

Persistent states and modes changes are covered in Section 5.4, “Permanent Changes in SELinux States and Modes”.