What is the Command output for 3 SELinux sestatus ?

Updated: 28 September 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9

sestatus shows whether SELinux is on and how it is set. Example on AlmaLinux 9:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

What the lines mean

• SELinux status: enabled or disabled in the kernel.
• Loaded policy name: targeted (the default) protects network services; other processes run unconfined.
• Current mode: enforcing blocks and logs, permissive only logs. Mode from config file is what applies after a reboot; if the two differ, someone ran setenforce.
• Policy MLS status: multi-level security support in the policy (enabled in the targeted policy, but not used for ordinary processes).
• Policy deny_unknown status: what happens to permissions the policy does not know (allowed by default).
• Max kernel policy version: the newest policy format the kernel supports.

Three common states

• enabled, enforcing: SELinux is protecting the system (default on AlmaLinux/Rocky).
• enabled, permissive: nothing is blocked, but denials are logged. Useful for troubleshooting.
• disabled: SELinux is off (required on cPanel servers).

Other quick checks: getenforce prints only the mode, and ls -Z / ps -eZ show the labels of files and processes.