ExamFinch.com My Study

Study guide

20.1 Set Enforcing and Permissive Modes for SELinux

Practice this exam

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

20.1 Set Enforcing and Permissive Modes for SELinux

Key Takeaways Explain This Topic AI

Check the current mode with getenforce (or sestatus); temporary runtime changes use setenforce 1 (Enforcing) or setenforce 0 (Permissive).

Persistent boot mode is configured in /etc/selinux/config with SELINUX=enforcing, permissive, or disabled—edit the file and reboot for the permanent change to take effect.

Enforcing blocks denials; Permissive logs denials but allows the action—use Permissive for diagnosis, not as a permanent “fix” unless the task requires it.

Disabled turns SELinux off entirely and may require a full relabel when re-enabled; EX200 tasks usually want Enforcing with correct labels, not Disabled.

Always re-verify with getenforce and sestatus after setenforce or config edits so the runtime mode and the config file match the intended end state.

Last updated: August 2026

20.1 Set Enforcing and Permissive Modes for SELinux

Quick Answer: Check mode with getenforce or sestatus . Temporary change: setenforce 1 (Enforcing) or setenforce 0 (Permissive). Permanent boot default: edit /etc/selinux/config ( SELINUX=enforcing|permissive|disabled ) and reboot . Prefer fixing labels and policy over leaving the system Disabled.

Why SELinux mode matters on EX200

Under Manage security , Red Hat expects you to set enforcing and permissive modes for SELinux . Lab language looks like:

  • “Ensure SELinux is in enforcing mode.”
  • “Temporarily set SELinux to permissive to diagnose a service failure.”
  • “Configure the system so SELinux boots in enforcing mode.”
  • “Report the current SELinux mode.”

You are graded on runtime mode and, when the task requires it, mode after reboot . Mode is only half of SELinux skill—contexts, booleans, and port labels appear in later sections—but if the mode is wrong, nothing else behaves as the grader expects.

What SELinux modes mean

  • Mode Policy loaded? Denials blocked? Typical use
  • Enforcing Yes Yes Production and default EX200 target
  • Permissive Yes No (logged only) Diagnose AVC denials without breaking access
  • Disabled No N/A SELinux off; not a normal “fix” for services

In Enforcing , the kernel security module applies the loaded policy and denies unauthorized subject/object access. In Permissive , the same policy decisions are evaluated and logged (AVC messages), but the action is allowed . That makes Permissive excellent for proving “SELinux would have blocked this” without stranding a service mid-exam.

Disabled means SELinux is not active. Turning SELinux from Disabled back to Enforcing often triggers a full filesystem relabel on the next boot and can take significant time—dangerous under exam time pressure. Prefer Enforcing with correct contexts over disabling SELinux unless a task explicitly demands Disabled (rare for standard RHCSA flows).

  • Check current mode getenforce
  • sestatus

# optional:

cat /etc/selinux/config | grep -E '^SELINUX='

getenforce prints a single word: Enforcing , Permissive , or Disabled —fastest check under time pressure.

sestatus shows richer detail:

  • SELinux status (enabled/disabled)
  • Current mode (runtime)
  • Mode from config file (boot default)
  • Policy name (commonly targeted on RHEL)
  • Policy MLS status and other fields sestatus

# Look for lines similar to:

  • # SELinux status: enabled
  • # Current mode: enforcing
  • # Mode from config file: enforcing
  • # Policy from config file: targeted

Exam habit: If current mode and config-file mode disagree, you have a temporary runtime override (from setenforce ) or a config change that has not been rebooted yet. Resolve that mismatch intentionally.

  • Temporary mode: setenforce sudo setenforce 1 # Enforcing
  • sudo setenforce 0 # Permissive
  • getenforce

You may also see symbolic arguments on some systems ( Enforcing / Permissive ), but 0 and 1 are universal and safe to memorize for RHEL:

  • Command Result
  • setenforce 1 Runtime Enforcing
  • setenforce 0 Runtime Permissive

Important limits:

setenforce does not survive reboot. Boot mode comes from /etc/selinux/config (and related boot options).

setenforce cannot switch from Disabled to Enforcing. If SELinux is fully disabled, you must edit the config and reboot (often with a relabel).

Switching Enforcing ↔ Permissive with setenforce is immediate and does not require a reboot.

  • Diagnostic pattern with Permissive
  • When a service fails and you suspect SELinux: getenforce
  • sudo setenforce 0
  • # reproduce the service start / access that failed
  • # check logs if needed, then restore enforcing when done diagnosing
  • sudo setenforce 1
  • getenforce

If the problem disappears in Permissive , SELinux was involved. The durable fix is usually labels , booleans , or port labels —not leaving the host in Permissive forever. Chapter 21 covers booleans and port labels; this section owns mode control.

  • Persistent mode: /etc/selinux/config sudo cat /etc/selinux/config
  • Key directives (simplified): SELINUX=enforcing
  • SELINUXTYPE=targeted
  • Setting Meaning
  • SELINUX=enforcing Boot into Enforcing
  • SELINUX=permissive Boot into Permissive
  • SELINUX=disabled SELinux off after reboot
  • SELINUXTYPE=targeted Default RHEL policy type (do not change casually)
  • Edit carefully: sudo grep '^SELINUX=' /etc/selinux/config
  • # Example: force enforcing at next boot
  • sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
  • grep '^SELINUX=' /etc/selinux/config

Or use a text editor ( vim , nano ) and change only the SELINUX= line. Do not set SELINUXTYPE to experimental values on the exam unless the task says so.

  • Reboot is required for config-file mode sudo grep '^SELINUX=' /etc/selinux/config
  • sudo reboot

# after reboot:

  • getenforce
  • sestatus

Until reboot:

getenforce still reflects the current runtime mode.

sestatus may show “Mode from config file” already updated while “Current mode” still shows the old runtime value if you also used setenforce differently.

Exam workflow for permanent Enforcing:

Set SELINUX=enforcing in /etc/selinux/config .

Optionally setenforce 1 so runtime matches now without waiting for reboot.

Verify both runtime and config.

Reboot if the lab requires proving persistence (or if you changed Disabled ↔ enabled).

getenforce / setenforce / config map

  • Goal Commands
  • See runtime mode getenforce
  • See runtime + config + policy sestatus
  • Immediate Enforcing setenforce 1
  • Immediate Permissive setenforce 0
  • Boot Enforcing forever SELINUX=enforcing in config (+ reboot)
  • Boot Permissive forever SELINUX=permissive in config (+ reboot)
  • Turn SELinux off at boot SELINUX=disabled (+ reboot)—avoid unless required
  • Disabled and the relabel trap

If SELinux was Disabled and you set SELINUX=enforcing (or permissive) again:

On next boot the system may schedule a relabel of the filesystem so labels match policy.

Relabel can be forced with a /.autorelabel file and reboot (advanced recovery pattern). # Awareness only — full relabel costs time:

# sudo touch /.autorelabel && sudo reboot

On EX200, do not disable SELinux as a shortcut to make Apache/NFS/SSH “just work.” Fix the label or boolean instead. If a previous admin left SELinux disabled, re-enabling is a multi-step recovery—budget time carefully.

  • Logs and evidence of mode-related denials
  • While diagnosing (often in Permissive): sudo ausearch -m avc -ts recent 2>/dev/null | tail
  • sudo journalctl -t setroubleshoot --since "10 min ago" 2>/dev/null | tail
  • sudo tail -n 50 /var/log/audit/audit.log

Exact tooling availability can vary, but audit AVC messages are the classic SELinux denial trail. Mode itself does not “write a special config” for denials—policy and labels do. Mode only decides whether denials are enforced.

  • Verification checklist getenforce
  • sestatus
  • grep -E '^SELINUX=|^SELINUXTYPE=' /etc/selinux/config

Confirm:

Runtime mode matches the task ( Enforcing is the common end state).

Config file matches if the task says “on boot,” “persistently,” or “after reboot.”

You did not leave the host in Permissive after a diagnostic detour unless that was required.

  • Exam workflows
  • Workflow A — Prove current mode getenforce
  • sestatus | egrep 'status|Current mode|Mode from config|Policy from config'
  • Workflow B — Temporary Permissive, then back to Enforcing getenforce
  • sudo setenforce 0
  • getenforce

# ... diagnose or complete a step that required permissive ...

  • sudo setenforce 1
  • getenforce

Workflow C — Persistent Enforcing (runtime + boot) sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

  • sudo setenforce 1
  • getenforce
  • grep '^SELINUX=' /etc/selinux/config
  • sestatus

Workflow D — Boot Permissive by policy of the task sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config

  • sudo setenforce 0
  • getenforce
  • grep '^SELINUX=' /etc/selinux/config
  • # reboot if required to prove boot mode
  • Workflow E — Detect mismatch echo "runtime: $(getenforce)"
  • echo -n "config: "; grep '^SELINUX=' /etc/selinux/config
  • sestatus

If runtime is Permissive but config is enforcing, someone ran setenforce 0 —or you did. Decide whether to restore Enforcing now.

Common traps

Editing /etc/selinux/config only and assuming runtime changed without setenforce or reboot.

Using only setenforce 1 when the task requires the boot default to be Enforcing—config file still says permissive / disabled .

Leaving Permissive after troubleshooting so denials never block (and the grader may still expect Enforcing).

Disabling SELinux to “fix” a web root or home directory path—wrong skill for EX200; use contexts (Section 20.3).

Expecting setenforce to enable SELinux when status is Disabled —needs config + reboot (and often relabel).

Changing SELINUXTYPE accidentally while editing the file.

Not verifying with getenforce after every mode change.

Confusing mode with context or boolean —mode is global; contexts are per object/process.

Forgetting that Permissive still loads policy and still logs denials—useful for diagnosis.

Burning exam time on a full relabel path that was never required.

Relationship to other sections

  • Skill Section
  • Modes (Enforcing/Permissive) 20.1 (this)
  • List file/process contexts 20.2
  • Restore default file contexts 20.3
  • Port labels 21.1
  • Booleans 21.2
  • firewalld / SSH keys / umask Chapter 19 (related security, not SELinux modes)

Services that fail only under Enforcing usually need correct labels or booleans , not a permanent mode demotion.

Section checkpoint

You should read the current mode with getenforce and sestatus , switch runtime Enforcing/Permissive with setenforce 1|0 , set the boot default in /etc/selinux/config , understand that config changes need reboot while setenforce is immediate and temporary, avoid casual Disabled , use Permissive for diagnosis , and leave the system in the mode the task requires—almost always Enforcing with a matching config on RHEL 10 for EX200.