s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

getenforce

Show the SELinux mode (getenforce), or switch between enforcing and permissive until the next reboot (setenforce).

Level
RHCSA exam
Group
SELinux and security
Needs root
For changes
Package
libselinux-utils
Also called
setenforce

What it does

getenforce prints Enforcing, Permissive or Disabled. setenforce 0 switches to permissive (log only), setenforce 1 back to enforcing. It does not work when SELinux is disabled, and it does not change the boot mode — that is SELINUX= in /etc/selinux/config.

How to write it

getenforce
setenforce Enforcing|Permissive|1|0

Options 2

Most used

1, Enforcing
Enforce the policy.
0, Permissive
Only log denials.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Show the mode

    getenforce
Enforcing

    The normal state.

  2. 2Permissive for a test

    setenforce 0
getenforce
Permissive

    If the problem is gone now, SELinux was the cause.

  3. 3Back to enforcing

    setenforce 1

    Never forget this step.

  4. 4Mode at boot

    grep ^SELINUX= /etc/selinux/config
SELINUX=enforcing

    Change here for the next boot.

  5. 5Test a service quickly

    setenforce 0; systemctl restart httpd; curl -I localhost; setenforce 1

    Compare the result with enforcing.

  6. 6Better: only one domain permissive

    semanage permissive -a httpd_t

    The rest of the system stays protected.

  7. 7Disabled system

    setenforce 1
setenforce: SELinux is disabled

    Needs a config change, relabel and reboot.

  8. 8In a monitoring check (security)

    [ "$(getenforce)" = Enforcing ] || echo "ALERT: SELinux not enforcing on $(hostname)"

    Attackers often switch SELinux off.

  9. 9Check the kernel arguments

    grep -o 'selinux=[01]\|enforcing=[01]' /proc/cmdline

    selinux=0 disables SELinux; enforcing=0 boots permissive.

  10. 10Logged mode changes

    ausearch -m MAC_STATUS -ts today

    Who changed the mode and when.

Exit codes

0 :: Done. 1 :: Error (for example SELinux disabled).

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man 8 getenforce

Open the man page (linux.die.net)man7.org