> For the complete documentation index, see [llms.txt](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/txt-files/file-systems-cocepts/lpic3-303/getenforce.md).

# getenforce

The `getenforce` command in Linux is used to retrieve the current enforcing mode of SELinux (Security-Enhanced Linux) on the system. SELinux is a Linux kernel security module that provides enhanced access control mechanisms, including mandatory access controls (MAC). Here’s an overview of `getenforce`, its usage, and significance:

### Purpose of `getenforce`

The main purpose of `getenforce` is to:

* Display the current enforcement mode of SELinux on the system.
* Provide information about whether SELinux is enforcing security policies, permissive (logging but not enforcing), or disabled.

### Key Features and Functionality

1. **Display SELinux Mode**: `getenforce` displays one of the following modes:
   * `Enforcing`: SELinux security policies are actively enforced, and access violations are logged and prevented.
   * `Permissive`: SELinux logs access violations but does not enforce security policies. This mode is often used for troubleshooting or auditing purposes.
   * `Disabled`: SELinux is not active on the system.
2. **System Integration**: `getenforce` is integrated into the SELinux framework and provides a straightforward way to check the current operational mode.

### Usage

To use `getenforce`, open a terminal and simply type:

```bash
getenforce
```

### Example Output

The output of `getenforce` typically shows the current SELinux mode:

* Example 1: SELinux Enforcing

  ```plaintext
  Enforcing
  ```
* Example 2: SELinux Permissive

  ```plaintext
  Permissive
  ```
* Example 3: SELinux Disabled

  ```plaintext
  Disabled
  ```

### Benefits

* **Security Compliance**: Helps administrators verify that SELinux is enforcing security policies as expected.
* **Troubleshooting**: Allows administrators to check if SELinux is the cause of access-related issues by switching to permissive mode temporarily.
* **Auditing**: Provides insight into SELinux activity and access violations, aiding in security audits and incident investigations.

### Security Considerations

* **Enforcement Impact**: Enabling SELinux enforcing mode enhances system security by enforcing mandatory access controls (MAC) defined by security policies.
* **Configuration**: Ensure SELinux policies are properly configured to align with security requirements and application needs.

### Conclusion

`getenforce` is a fundamental command for checking the current enforcement mode of SELinux on Linux systems. By using `getenforce`, administrators can ensure that SELinux is actively enforcing security policies, troubleshoot access issues, and maintain a secure system environment.