SELinux Mode Changer is a Magisk module that lets the installer choose enforcing or permissive mode and reapplies that selection during early boot.
Choose the SELinux State
The installer writes the selected setenforce command into the module's early-boot script.
Enforcing
Requests setenforce 1, which keeps the kernel's SELinux policy active.
Permissive
Requests setenforce 0, which logs policy denials without blocking them.
Installer selection
Uses volume-key input to select one of the two modes during setup.
What the installer changes
Version 2.6.2 presents a volume-key selector and rewrites post-fs-data.sh with either setenforce 1 or setenforce 0. It does not create fine-grained SELinux allow rules. The result also depends on whether the firmware permits a runtime enforcement change.
Installation
- Read the upstream warning about permissive mode before choosing a state.
- Install the release ZIP through Magisk and use the volume keys to select enforcing or permissive as prompted.
- Reboot and check the actual state with
getenforcefrom a root shell.
Security and recovery
Permissive mode affects the whole device and can change how security-sensitive apps evaluate it. For debugging, capture the relevant AVC denials, create the narrow policy fix, and return to enforcing mode. Remove or disable this module and reboot if its selected state is no longer wanted. The repository does not document KernelSU or APatch support, so those platforms are not listed as verified here.