Default SELinux status and modes for AL2027

For AL2027, SELinux is enabled and set to enforcing mode by default. In enforcing mode, SELinux actively enforces the loaded security policy on the entire system.

To find the current SELinux status, policy, and mode, run the getenforce or sestatus command.

With the default status set to enabled and enforcing, the getenforce command returns Enforcing.

The sestatus command returns the SELinux status and the current SELinux policy as shown in the following example:

$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      35

When you run SELinux in permissive mode, you might label files incorrectly. When SELinux is disabled, files aren't labeled. Both incorrectly labeled and unlabeled files can cause problems in enforcing mode.

SELinux automatically relabels files to avoid this problem. SELinux prevents labeling problems with automatic relabeling when you change the status to enabled.