Function selinux_ensure_install_or_setenforce 

pub(crate) fn selinux_ensure_install_or_setenforce() -> Result<Option<SetEnforceGuard>>

Try to enter the install_t domain, but if we can’t do that, then just setenforce 0.