SELinux: Read the Enforcement Mode

You're triaging an SELinux issue and need to know the configured mode. The persistent setting lives in /etc/selinux/config (it differs per session). Read it and record the active SELINUX mode (enforcing, permissive, or disabled) to /root/answers/selinux_mode.txt.

grep '^SELINUX=' /etc/selinux/config

Don't confuse SELINUX= (the mode) with SELINUXTYPE= (the policy), and a commented-out #SELINUX= line isn't in effect. (getenforce shows the live mode; the config file is the boot-time setting.)