🚨 SELinux Error: 'setenforce: SELinux is disabled' — Cause, Fix, and Troubleshooting Guide

What this error means

You ran setenforce 1 to turn SELinux enforcement on, but SELinux is fully disabled (not merely permissive), so there is no policy loaded to switch into enforcing mode. setenforce only toggles between permissive and enforcing; it cannot revive a disabled SELinux at runtime.

setenforce: SELinux is disabled

The distinction matters: SELINUX=disabled unloads the policy entirely and stops labeling files, whereas permissive keeps the policy loaded and labels current but logs instead of blocks. Re-enabling from disabled requires a config change, a filesystem relabel, and a reboot.

How it manifests on the host

• sudo setenforce 1 returns setenforce: SELinux is disabled and enforcement stays off.
• getenforce prints Disabled.
• A CIS/STIG scan flags SELinux as not enforcing.
• sestatus shows SELinux status: disabled.

System configuration causes

• Disabled in config. /etc/selinux/config has SELINUX=disabled (often a leftover from earlier troubleshooting).
• Disabled on the kernel command line. selinux=0 is set in GRUB, overriding the config file.
• Never labeled filesystem. Running disabled for a long time means files lack SELinux labels; enabling straight to enforcing would break the system without a relabel.
• Minimal/cloud image shipped with SELinux disabled by default.

Interrogating the host

# Current mode and config vs. runtime
sestatus
getenforce
grep -E '^SELINUX=' /etc/selinux/config

# Is it disabled on the kernel command line? (overrides config)
grep -o 'selinux=[01]' /proc/cmdline

getenforce returning Disabled (not Permissive) confirms the policy is unloaded, which is why setenforce refuses.

Remediation

Re-enabling safely is deliberate: go through permissive first, relabel, verify, then enforce.

1. Remove any kernel-level disable so config can take effect. Edit /etc/default/grub, delete selinux=0 (and enforcing=0) from GRUB_CMDLINE_LINUX, then rebuild:

sudo grep selinux /etc/default/grub
# remove selinux=0, then:
sudo grub2-mkconfig -o /boot/grub2/grub.cfg   # BIOS; use the EFI path on UEFI hosts

2. Set the config to permissive and force a full relabel on next boot:

sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
sudo touch /.autorelabel
sudo reboot

The relabel applies correct contexts to every file (necessary after running disabled).

3. After reboot, confirm and review denials before enforcing:

getenforce        # should now say Permissive
sudo ausearch -m avc -ts recent      # collect what WOULD have been denied

4. Switch to enforcing once the AVC log is clean:

sudo setenforce 1
sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

Hardening the host

• Never jump straight from disabled to enforcing without a relabel — unlabeled files can make the system unbootable or lock out logins.
• The kernel selinux=0 argument overrides /etc/selinux/config; check /proc/cmdline if config edits seem ignored.
• Use permissive mode to gather AVCs first; enforce only after the denials are understood and policy is adjusted.
• A relabel of a large filesystem can take a while on first boot — plan for the extra downtime.

Related system errors

• SELinux ‘avc: denied’ Error Guide
• SELinux Troubleshooting Without Permissive Mode
• CIS Benchmark Hardening for Linux Servers