How to Enforce SELinux

Step 1: Review Denials in Permissive Mode

sudo ausearch -m avc -ts recent

Step 2: Generate Policy Modules

sudo grep "denied" /var/log/audit/audit.log | audit2allow -m mymodule > mymodule.te
sudo audit2allow -a -M mymodule
sudo semodule -i mymodule.pp

Step 3: Set Enforcing Mode

sudo setenforce 1

Step 4: Make Permanent

sudo nano /etc/selinux/config
SELINUX=enforcing

Step 5: Boot with Enforcing

sudo reboot