-
Notifications
You must be signed in to change notification settings - Fork 10
Linux ‐ SELinux enforcing mode
'SELinux enforcing mode' rule checks out in which mode SELinux runs.
Enforcing mode is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system.
In permissive mode, the system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development and debugging.
Disabled mode is strongly discouraged; not only does the system avoid enforcing the SELinux policy, it also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future.
Run the following command on each node to get SELinux mode:
/usr/sbin/getenforce
Include links to related documentation, knowledge-base articles, or external references.