[$] Disabling SELinux's runtime disable

Distributors have been enabling the SELinux security module for nearly
20 years now, and many administrators have been disabling it on their
systems for almost as long. There are a few ways in which SELinux can be
disabled on any given system, including command-line options, a run-time
switch, or simply not loading a policy after boot. One of those ways,
however, is about to be disabled itself.

Source: LWN.net – [$] Disabling SELinux’s runtime disable