SELinux: status, enforcement, and boolean policies

SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) layer for Linux.

Current status

sestatus

Enable or disable enforcement (runtime)

setenforce 1   # enforcing
setenforce 0   # permissive

Boolean policies

List all booleans and their state (on / off):

getsebool -a

Change a boolean permanently (-P writes to policy):

setsebool -P <policy-name> on
setsebool -P <policy-name> off

Further reading

• open_in_new Using NGINX and NGINX Plus with SELinux