LFCS 140 🐧 SELinux — Concepts and Modes - KandZ

⏱️ Estimated read: 9 min | |

SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) system implemented in the Linux kernel. Unlike the traditional discretionary access control (DAC) model, where the file owner decides who can access a resource, SELinux uses a security policy that the system enforces regardless of the user’s identity or the file’s permissions . Every process, file, and socket is assigned a security context, and every action is checked against the policy. The LFCS exam tests the conceptual model: the three modes (Enforcing, Permissive, Disabled), the configuration file that selects the mode, and the commands that inspect the current state. The critical trap is the difference between disabling SELinux via the configuration file and disabling it via the kernel boot parameter. The configuration file is deprecated for disabling, and the kernel parameter is the only reliable method .

Key point: SELinux has three modes. Enforcing mode denies access based on the policy. Permissive mode allows access but logs the denial. Disabled mode turns off the SELinux code entirely. The mode is configured in /etc/selinux/config with the SELINUX= variable, and the change takes effect after a reboot. The getenforce command shows the current mode, and the sestatus command shows the full status including the loaded policy.

Why SELinux modes require a specific mental model

The DAC versus MAC problem. A file with permissions 777 is readable and writable by everyone under the DAC model. SELinux ignores the 777 if the policy says the process’s domain cannot access the file’s type. The policy is the authority, not the file mode. This is the core of the MAC model: the system-wide policy overrides the user’s discretionary decisions .

The enforcing problem. In enforcing mode, the kernel checks every action against the policy. If the policy does not allow the action, the action is denied, and an AVC (Access Vector Cache) message is logged to the audit log or the systemd journal. The denial is the signal that the policy does not cover the action, and the fix is to adjust the policy or the context, not to disable SELinux .

The permissive problem. In permissive mode, the policy is not enforced. The action is allowed, but the denial is logged as an AVC message. This is the diagnostic mode: it shows what would be denied in enforcing mode without breaking the application. The recommended workflow for enabling SELinux on a system that had it disabled is to boot in permissive mode first, resolve the AVC messages, then switch to enforcing .

The disabled problem. In disabled mode, the SELinux kernel code is not loaded. No policy is enforced, and no AVC messages are generated. The problem is that files created while SELinux is disabled are not labeled with a security context. When the system is switched back to permissive or enforcing, the files must be relabeled, or the system may fail to boot. The selinux=0 kernel parameter is the correct way to disable SELinux, not the SELINUX=disabled setting in the configuration file .

The trade-off. Enforcing mode is the secure state. Permissive mode is the diagnostic state. Disabled mode is the insecure state. The exam tests the commands that show the current mode and the configuration file that selects the mode. A candidate who confuses the configuration file with the kernel parameter fails the persistence test.

a. The three modes and the configuration file

SELinux is controlled by the /etc/selinux/config file. The SELINUX= variable accepts three values: enforcing, permissive, or disabled. The SELINUXTYPE= variable selects the policy: targeted (the default on RHEL and Fedora) or mls (Multi-Level Security) .

# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

The change to the mode is not immediate. The system must be rebooted for the new mode to take effect. The setenforce command changes the mode at runtime, but only between enforcing and permissive. It cannot switch to disabled or from disabled .

The getenforce command returns the current mode: Enforcing, Permissive, or Disabled. The sestatus command returns the full status: the current mode, the mode from the configuration file, the loaded policy, and the number of allowed and denied actions.

# Show the current mode
getenforce

# Show the full status
sestatus

The setenforce 0 command switches to permissive mode at runtime. The setenforce 1 command switches back to enforcing. The change is lost on reboot; the configuration file is the persistent source .

b. The `getenforce` and `sestatus` commands

The getenforce command is the simplest way to check the current mode. It returns a single word: Enforcing, Permissive, or Disabled.

getenforce
# Output: Enforcing

The sestatus command is the comprehensive view. It shows the current mode, the mode from the configuration file, the loaded policy, the policy version, and the status of the SELinux filesystem.

sestatus
# SELinux status:                 enabled
# SELinuxfs mount:                /sys/fs/selinux
# SELinux root directory:         /etc/selinux
# Loaded policy name:             targeted
# Current mode:                   enforcing
# Mode from config file:          enforcing
# Policy MLS status:              enabled
# Policy deny_unknown status:     allowed
# Max kernel policy version:      33

The sestatus output confirms that the mode from the configuration file matches the current mode. If they differ, the setenforce command was used to change the runtime mode without changing the configuration file.

c. The boot parameter and the relabeling problem

The SELINUX=disabled setting in the configuration file is deprecated. On some kernel versions, the SELinux hooks are still executed even when the configuration file says disabled, and the system behaves as if SELinux is enabled but without a policy. The reliable way to disable SELinux is the selinux=0 kernel boot parameter .

# /etc/default/grub (or the equivalent)
GRUB_CMDLINE_LINUX="... selinux=0"

The selinux=0 parameter prevents the SELinux code from being loaded at boot. The enforcing=0 parameter boots in permissive mode, which is the recommended step when re-enabling SELinux on a system that had it disabled .

The relabeling problem is the consequence of disabling SELinux. Files created while SELinux was disabled do not have a security context. When the system is switched back to permissive or enforcing, the selinux-autorelabel service relabels the filesystem. The relabeling process can take time, and if it fails, the system may not boot. The recommended procedure is to boot in permissive mode first, verify that the system is operational, then switch to enforcing .

Complete Example Session

# ============================================
# PART 1: CHECK THE CURRENT MODE
# ============================================

getenforce
# Output: Enforcing

# ============================================
# PART 2: CHECK THE FULL STATUS
# ============================================

sestatus
# Shows the current mode, config mode, and policy.

# ============================================
# PART 3: SWITCH TO PERMISSIVE AT RUNTIME
# ============================================

sudo setenforce 0
getenforce
# Output: Permissive

# ============================================
# PART 4: SWITCH BACK TO ENFORCING
# ============================================

sudo setenforce 1
getenforce
# Output: Enforcing

# ============================================
# PART 5: CHANGE THE PERSISTENT MODE
# ============================================

sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
grep SELINUX= /etc/selinux/config
# Output: SELINUX=permissive

# ============================================
# PART 6: REBOOT TO APPLY
# ============================================

sudo reboot

# ============================================
# PART 7: VERIFY AFTER REBOOT
# ============================================

getenforce
# Output: Permissive

# ============================================
# PART 8: DISABLE SELINUX VIA KERNEL PARAMETER
# ============================================

# Edit /etc/default/grub
# Add selinux=0 to GRUB_CMDLINE_LINUX
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
sudo reboot

# ============================================
# PART 9: VERIFY DISABLED STATE
# ============================================

getenforce
# Output: Disabled

The nine parts trace the SELinux modes: current mode, full status, runtime permissive, runtime enforcing, persistent change, reboot, verification, kernel parameter, and disabled state.

Quick Reference

Modes

Mode	Behavior
`Enforcing`	Denies access and logs AVC
`Permissive`	Allows access and logs AVC
`Disabled`	No SELinux code

Configuration

Setting	Location
`SELINUX=`	`/etc/selinux/config`
`SELINUXTYPE=`	`/etc/selinux/config`
`selinux=0`	Kernel boot parameter
`enforcing=0`	Boot in permissive mode

Commands

Command	Purpose
`getenforce`	Current mode
`sestatus`	Full status
`setenforce 0`	Switch to permissive (runtime)
`setenforce 1`	Switch to enforcing (runtime)

Common Workflow

Step	Command
1	`setenforce 0`
2	Test the application
3	`ausearch -m AVC`
4	Fix the policy
5	`setenforce 1`

Best Practices

✅ Do This:

getenforce
<!-- Check the current mode -->                       # ✅

sestatus
<!-- Check the full status -->                        # ✅

setenforce 0
<!-- Use permissive mode for diagnosis -->            # ✅

❌ Don’t Do This:

# Disable SELinux to fix an application
<!-- Use permissive mode and fix the policy -->       # ❌

# Rely on SELINUX=disabled in the config file
<!-- Use selinux=0 kernel parameter -->               # ❌

# Assume setenforce is persistent
<!-- It is runtime only -->                           # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Application denied in enforcing	Policy does not cover the action	Use permissive, check AVC, fix policy
System fails to boot after enabling	Unlabeled files	Boot with `enforcing=0`, relabel
`setenforce 0` fails	SELinux is disabled	Enable in config and reboot
Mode mismatch	`setenforce` changed runtime only	Edit config file and reboot
Files not labeled	Created while disabled	Relabel with `restorecon`

Real-World Examples

1. Check Mode

getenforce

2. Full Status

sestatus

3. Permissive Runtime

sudo setenforce 0

4. Enforcing Runtime

sudo setenforce 1

5. Persistent Permissive

SELINUX=permissive

6. Persistent Enforcing

SELINUX=enforcing

7. Disable via Kernel

selinux=0

8. Boot Permissive

enforcing=0

9. Check AVC

sudo ausearch -m AVC -ts today

10. Check Status After Reboot

getenforce

Visual

SELinux Modes

┌──────────────────────────────────────────────┐
│  Enforcing                                   │
│  ├── Denies access                           │
│  ├── Logs AVC                                │
│  └── Secure state                            │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Permissive                                  │
│  ├── Allows access                           │
│  ├── Logs AVC                                │
│  └── Diagnostic state                        │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Disabled                                    │
│  ├── No SELinux code                         │
│  ├── No AVC                                  │
│  └── Insecure state                          │
└──────────────────────────────────────────────┘

Runtime vs Persistent

┌──────────────────────────────────────────────┐
│  setenforce 0                                │
│  → Runtime change                            │
│  → Lost on reboot                            │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  /etc/selinux/config                         │
│  → Persistent change                         │
│  → Applied on reboot                         │
└──────────────────────────────────────────────┘

Summary

Item	Value
Mode configuration	`/etc/selinux/config`
Mode check	`getenforce`
Full status	`sestatus`
Runtime switch	`setenforce 0/1`
Disable method	`selinux=0` kernel parameter
Boot permissive	`enforcing=0` kernel parameter
Policy type	`SELINUXTYPE=targeted`
AVC log	`/var/log/audit/audit.log`

Key takeaways:

SELinux has three modes. Enforcing denies access and logs the denial. Permissive allows access but logs the denial. Disabled turns off the SELinux code entirely .
The configuration file is the persistent source. The SELINUX= variable in /etc/selinux/config sets the mode for the next boot. The setenforce command changes the runtime mode only .
getenforce and sestatus are the inspection commands. getenforce returns the current mode. sestatus returns the full status including the policy and the configuration file mode.
The selinux=0 kernel parameter is the correct way to disable. The SELINUX=disabled setting in the configuration file is deprecated and may not fully disable the SELinux hooks .
Re-enabling SELinux requires relabeling. Files created while SELinux was disabled do not have a context. The system relabels the filesystem on the first boot in permissive or enforcing mode. The recommended procedure is to boot in permissive first, fix the AVC messages, then switch to enforcing .

Remember: SELinux is a MAC system. The policy is the authority. The mode is the enforcement level. Enforcing is the goal. Permissive is the diagnostic. Disabled is the insecure fallback. The getenforce shows the mode. The sestatus shows the detail. The setenforce changes the runtime. The config file changes the boot.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!