selinux

var IsEnabled = sync.OnceValue(func() bool {
	if containermode.InContainer() {
		return false
	}

	val := procfs.ProcCmdline().Get(constants.KernelParamSELinux).First()

	var selinuxFSPresent bool

	if _, err := os.Stat("/sys/fs/selinux"); err == nil {
		selinuxFSPresent = true
	}

	return val != nil && *val == "1" && selinuxFSPresent
})

IsEnabled checks if SELinux is enabled on the system by reading the kernel command line. It returns true if SELinux is enabled, otherwise it returns false. It also ensures we're not in a container. By default SELinux is disabled.

var IsEnforcing = sync.OnceValue(func() bool {
	if !IsEnabled() {
		return false
	}

	val := procfs.ProcCmdline().Get(constants.KernelParamSELinuxEnforcing).First()

	return val != nil && *val == "1"
})

IsEnforcing checks if SELinux is enabled and the mode should be enforcing. By default if SELinux is enabled we consider it to be permissive.