getenforce

Install

# RHEL / Alma / Rocky
sudo dnf install policycoreutils

# Debian / Ubuntu
sudo apt install policycoreutils

# openSUSE
sudo zypper install policycoreutils

# Arch
sudo pacman -S policycoreutils

What it does

getenforce reports the current SELinux mode: Enforcing, Permissive, or Disabled. It provides a quick check of whether SELinux policy is actively enforced.

How it works (mechanical)

• Reads the current SELinux enforcement state from the kernel.
• Queries the SELinux subsystem via /sys/fs/selinux.
• Returns one of three values: Enforcing, Permissive, or Disabled.
• Does not modify system state (read-only command).

Quick Start

getenforce

10 Practical Examples

# 1) Check current SELinux mode
getenforce

# 2) Combine with setenforce (temporary change)
getenforce
sudo setenforce 0
getenforce

# 3) Use in scripts to verify enforcing mode
if [ "$(getenforce)" != "Enforcing" ]; then
  echo "SELinux not enforcing"
fi

# 4) Log current mode
echo "SELinux mode: $(getenforce)"

# 5) Verify after reboot
getenforce

# 6) Compare with sestatus
sestatus

# 7) Check before applying semanage rules
getenforce

# 8) Monitor in troubleshooting workflow
getenforce && sudo ausearch -m avc -ts recent

# 9) Use in conditional configuration scripts
MODE=$(getenforce)

# 10) Validate security baseline
getenforce

Notes & Gotchas

• Enforcing = policy actively blocks violations.
• Permissive = violations logged but not blocked.
• Disabled = SELinux not active at kernel level.
• Use setenforce for temporary mode changes.
• Permanent mode changes require editing /etc/selinux/config.

Related Commands

• setenforce — change SELinux enforcement mode (temporary).
• sestatus — detailed SELinux status report.
• semanage — manage persistent SELinux policy settings.
• restorecon — restore file contexts.
• audit2allow — generate policy rules from audit logs.