How do you permanently configure the SELinux mode?
Edit /etc/selinux/config: SELINUX= sets the mode (enforcing/permissive/disabled) and SELINUXTYPE= picks the policy (usually targeted); unlike setenforce, this is the PERSISTENT setting that survives reboot.
The division of labour: setenforce flips enforcing↔permissive right now but forgets on reboot, while this file is what the system reads at boot. So set both — setenforce for the running session, the config file so it sticks. One important gotcha: switching to/from disabled (rather than enforcing↔permissive) actually requires a reboot and a full filesystem relabel, because while disabled the kernel stops maintaining labels.
Configuration file: /etc/selinux/config
# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted
SELINUX values:
enforcing- Enforce policies (recommended)permissive- Log only, don't enforcedisabled- SELinux completely off
SELINUXTYPE values:
targeted- Protect specific processes (default)minimum- Only selected processes protectedmls- Multi-Level Security protection
View current configuration:
cat /etc/selinux/config
Important: Changes to this file require a reboot to take effect. For immediate changes, use setenforce.
Reference: man selinux_config(5), man getenforce(8), man setenforce(8)