I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot.
It's too easy for a root user to run setenforce permissive
, make changes - such as running unconfined programs, or changing contexts - and then re-enable enforcing mode. Sure, it'll be logged, but that may go unnoticed.