How to Check and Change SELinux Mode (Enforcing, Permissive, Disabled)

In this tutorial, you'll learn about How to Check and Change SELinux Mode (Enforcing, Permissive, Disabled). We cover key concepts, practical examples, and best practices.

The Problem

You need to check whether SELinux is enforcing, permissive, or disabled — either because an application is being blocked, you are hardening a system, or you are troubleshooting a permission error.

Quick Fix

Check the Current SELinux Mode

getenforce
# Enforcing
sestatus
# SELinux status:                 enabled
# Current mode:                   enforcing
# Mode from config file:          enforcing

getenforce prints the current mode. sestatus shows both the current and configured (persistent) mode, plus policy version and loaded policy name.

Temporarily Switch to Permissive Mode

sudo setenforce 0
getenforce
# Permissive

setenforce 0 sets SELinux to permissive mode without rebooting. In permissive mode, SELinux logs violations but does not block them. Use setenforce 1 to return to enforcing.

Permanently Change Mode in Configuration

sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
grep ^SELINUX= /etc/selinux/config
# SELINUX=permissive

Edit /etc/selinux/config to change the persistent mode. Set SELINUX=enforcing, SELINUX=permissive, or SELINUX=disabled. A reboot is required when switching from disabled to enforcing or permissive.

Fully Disable SELinux (Requires Reboot)

sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
sudo reboot
# Connection to host closed.
# ... after reboot ...
getenforce
# Disabled

Disabling SELinux requires a reboot. Use selinux=0 as a kernel boot parameter for a temporary disable that persists only until the next reboot.

Create SELinux Policy Modules with audit2allow

ausearch -m avc --start recent | audit2allow -M myapp_policy
# ******************** IMPORTANT ***********************
# To make this policy package active:
# semodule -i myapp_policy.pp
sudo semodule -i myapp_policy.pp

Instead of disabling SELinux, use audit2allow to create custom policy modules based on actual denials. This allows your application to work while keeping SELinux in enforcing mode.

Use Debug Mode for Risky Operations

# See every command before it executes
bash -x risky_script.sh
# + sudo sed -i 's/old/new/' /etc/fstab

Always use debug mode when running scripts that modify system configuration like fstab, SELinux settings, or firewall rules. This shows every command before it executes, catching typos early.

Additional Troubleshooting

# Check the error message and stack trace for more context
echo "Review the full error output to identify the root cause"

If the above steps do not resolve the issue, examine the complete error message and stack trace. Often the key detail is in the middle of the traceback rather than the final line. Search for the error message in the project documentation or issue tracker for additional solutions.

Prevention

• Use setenforce 0 only for troubleshooting — never run permissive in production permanently
• Check audit logs with ausearch -m avc or grep -i selinux /var/log/messages when debugging denials
• Create custom SELinux policy modules with audit2allow instead of disabling SELinux
• Document the required SELinux booleans for your application and enable them with setsebool -P