// Module included in the following assemblies:
//
// changing-selinux-states-and-modes.adoc

[#{context}-enabling-selinux]
= Enabling SELinux

When enabled, SELinux can run in one of two modes: enforcing or permissive. The following sections show how to permanently change into these modes.

While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, follow this procedure:

. In case your system has SELinux disabled at the kernel level (this is the recommended way, see <<{context}-disabling-selinux>>), make sure to undo that first.

.. Check if you have `selinux=0` in your kernel command line:
+
[subs="quotes"]
----
~]$ cat /proc/cmdline
_[...]_ rd.lvm.lv=fedora/swap rhgb quiet *selinux=0*
----

.. If it is there, remove it from the bootloader configuration using [command]`grubby`:
+
----
~]# grubby --update-kernel ALL --remove-args selinux
----

.. The change will be applied after you reboot the system (see below).

. Enable SELinux in permissive mode. For more information, see <<{context}-changing-to-permissive-mode>>.

. Reboot your system.

. Check for SELinux denial messages.
// For more information, see <<Fixing_Problems-Searching_For_and_Viewing_Denials>>.

. If there are no denials, switch to enforcing mode. For more information, see <<{context}-changing-to-enforcing-mode>>.

To run custom applications with SELinux in enforcing mode, choose one of the following scenarios:

* Run your application in the `unconfined_service_t` domain.
// See <<Targeted_Policy-Unconfined_Processes>> for more information.

* Write a new policy for your application. See the link:++https://access.redhat.com/solutions/117583++[Writing Custom SELinux Policy] Knowledgebase article for more information.

// Temporary changes in modes are covered in <<{context}-selinux-states-and-modes>>.
