semanage-permissive

List all process types in permissive mode

$ sudo semanage permissive -l

$ sudo semanage permissive -a [httpd_t]

$ sudo semanage permissive -d [httpd_t]

semanage permissive [-l|-a|-d] [domain]

semanage permissive manages per-domain permissive mode in SELinux. When a domain is set to permissive, SELinux logs policy violations but does not enforce them for processes in that domain.
This provides more granular control than global permissive mode (setenforce 0), allowing specific services to be unconfined while the rest of the system remains in enforcing mode.

-l, --list

List all domains in permissive mode

Add a domain to permissive mode

Remove a domain from permissive mode

Permissive domains are effectively unconfined and should only be used for troubleshooting. For production systems, configure proper SELinux policy rules instead of leaving domains in permissive mode. Requires root privileges.

semanage(8), setenforce(8), getenforce(8), audit2allow(1)