getenforce

getenforce is a command-line utility used on Linux systems running SELinux to report the current SELinux mode. It prints one of three words: Enforcing, Permissive, or Disabled, reflecting how SELinux is operating on the host. The tool is part of the policycoreutils package and queries the kernel via the SELinux runtime library to determine the status.

Enforcing means the SELinux policy is actively enforced by the kernel; policy decisions are applied to access requests and violations are denied. Permissive means the policy is loaded and evaluated, but enforcement is not performed; denials are logged for auditing and debugging. Disabled means SELinux is turned off and no policy is loaded or enforced.

Usage and practical considerations: Running getenforce displays the current mode and is commonly used in scripts to adjust behavior based on SELinux state. The mode can be changed at runtime with setenforce 0 to switch to Permissive or setenforce 1 to switch back to Enforcing, subject to system policy and privileges. Boot-time behavior can be influenced by kernel parameters on some distributions, such as enabling or disabling SELinux.

Related commands: sestatus provides a broader report of SELinux status, including the active mode, policy type, and enablement. getenforce is a focused, quick check of the mode, while sestatus offers more detail for troubleshooting or auditing.

Limitations: On systems without SELinux support or in containers where the subsystem is not exposed, getenforce may report Disabled or may be unavailable. The exact behavior can vary by distribution and kernel configuration.