getenforce(1)

getenforce reports the current mode of SELinux on the system. SELinux (Security Enhanced Linux) can operate in three modes: enforcing (policies are enforced), permissive (violations are logged but not enforced), or disabled (SELinux is not active).

This command requires no arguments and returns a single line indicating the active enforcement mode. It reads the current state from the kernel, not from configuration files, so it shows the actual runtime status.

Display the current SELinux enforcement mode (e.g., Enforcing, Permissive, or Disabled)

getenforce

Check if SELinux is in enforcing mode and print a message

if [ $(getenforce) = 'Enforcing' ]; then echo 'SELinux is enforcing'; fi

Test enforcement status and echo appropriate message

getenforce | grep -q Enforcing && echo 'Protected' || echo 'Not enforced'

Monitor SELinux mode changes in real-time (updates every 2 seconds)

watch getenforce