The Three Modes
SELinux operates in one of three modes, and understanding when to use each is critical for both operations and debugging:
1. Enforcing — The production mode. The policy is fully active. Any operation that violates policy is blocked and logged as an AVC denial. This is the default on RHEL/CentOS/Fedora systems.
2. Permissive — The debugging mode. The policy is evaluated and violations are logged, but nothing is actually blocked. The system behaves as if SELinux were off, but the audit log fills up with what would have been denied. This is invaluable for testing a new policy or diagnosing why an application is broken.
3. Disabled — SELinux hooks are completely removed from the kernel's execution path. This requires a reboot to change (because the kernel must be started without loading the LSM). Additionally, when SELinux is disabled, files created or modified do not receive labels. Re-enabling SELinux after it has been disabled requires a full filesystem relabel on the next boot, which can take many minutes on large systems.
Checking current status: sestatus gives a detailed report — policy name, current mode, whether MLS is enabled, and more. getenforce gives the quick one-word answer: Enforcing or Permissive.
Changing modes: setenforce flips between Enforcing and Permissive at runtime, but that change does not survive a reboot — it only lasts until the machine restarts or setenforce is run again. To make the mode change persistent, you edit the SELINUX= line in /etc/selinux/config, which is what the kernel reads at boot.
The cardinal rule of SELinux operations: never set SELINUX=disabled to solve a problem. This is the equivalent of disabling your firewall because a port is blocked. Switch to Permissive, read the audit logs, understand the denial, fix the root cause (wrong label, missing policy rule, or genuinely unauthorized access), and switch back to Enforcing. Disabling SELinux entirely removes all MAC protection and leaves unlabeled files that cause problems when you try to re-enable it later.