SELinux Modes Explained: setenforce, getenforce and Troubleshooting

SELinux is mandatory access control for Linux. Standard Linux permissions are discretionary — the owner of a file decides who may read it. SELinux adds a policy layer that the owner cannot override, enforced by the kernel against every process.

The practical consequence, and the reason it appears on the exam, is that a process can be denied access to a file its Unix permissions clearly allow.

The three modes

Mode	Behaviour
Enforcing	Policy is applied; violations are blocked and logged
Permissive	Policy is not applied; violations are logged only
Disabled	SELinux is off; nothing is enforced or logged

Permissive is the diagnostic mode. It lets you confirm whether SELinux is the cause of a problem without leaving the system unprotected, and it records every denial that would have occurred — so you can fix all of them at once rather than one reboot at a time.

Checking and changing the mode

getenforce prints the current mode. sestatus gives fuller detail, including the mode from the config file and the loaded policy.

setenforce 1 or setenforce Enforcing switches to enforcing. setenforce 0 or setenforce Permissive switches to permissive.

Two limits on setenforce that the exam tests directly.

It is temporary. The change lasts until reboot. A persistent change requires editing /etc/selinux/config and setting SELINUX=enforcing or permissive.

It cannot enable or disable SELinux. setenforce only toggles between enforcing and permissive. Moving to or from disabled requires the config file and a reboot, because the kernel must load — or not load — the policy at boot. If a question asks how to disable SELinux and offers setenforce 0, that is the wrong answer: it makes SELinux permissive, not disabled.

Disabling entirely is discouraged. Beyond losing protection, file contexts stop being maintained, so re-enabling later requires a full relabel of the file system.

Contexts

Every file, process and port carries a security context, shown with ls -Z, ps -Z or id -Z. It looks like system_u:object_r:httpd_sys_content_t:s0, and the part that matters in practice is the type — httpd_sys_content_t.

Policy is built on types. The web server process runs as httpd_t and policy permits httpd_t to read httpd_sys_content_t. Put a file with the wrong type where the web server expects content and access is denied regardless of its Unix permissions.

This is by far the most common real-world SELinux problem: files moved with mv keep their original context, while files copied with cp inherit the destination's. Moving content into /var/www/html from a home directory therefore breaks it, and copying the same file works.

Fix it with restorecon -Rv /var/www/html, which resets contexts to the policy default. To change the default itself, use semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?" and then run restorecon. chcon changes a context directly but does not survive a relabel, so it is for testing rather than permanent configuration.

Booleans

Booleans are policy switches that turn optional behaviour on and off without writing policy. getsebool -a lists them; setsebool -P httpd_can_network_connect on sets one persistently.

The -P matters — without it the change is lost at reboot, the same trap as setenforce. If a web application cannot reach a database on another host, the answer is often that boolean rather than a firewall rule.

Diagnosing a denial

A workable order. Confirm SELinux is responsible by checking whether the problem disappears in permissive mode. Look for AVC denials in /var/log/audit/audit.log, or use ausearch -m avc -ts recent. Run sealert -a /var/log/audit/audit.log if setroubleshoot is installed, since it usually names the fix.

Then work through the likely causes in order: wrong file context, needs restorecon; a boolean that should be on; a non-standard port that needs semanage port -a; and only as a last resort a custom policy module built with audit2allow.

Treat audit2allow with care. It generates a rule permitting exactly what was denied, which is convenient and can quietly grant far more than intended. Read what it produces before loading it.

What to remember

SELinux is mandatory access control; it overrides ordinary permissions. Enforcing blocks and logs, permissive only logs, disabled does neither. setenforce toggles enforcing and permissive only, and only until reboot; /etc/selinux/config makes it persistent and is the only way to disable. Contexts drive policy, mv preserves the old context while cp inherits the new one, and restorecon fixes it. Use -P with setsebool.

Related reading: Linux permissions · ext3 and ext4 · The APT package manager