I flash a custom ROM to my HTC B2UL.
The ROM, by default, has the SELinux policy set to Permissive instead of Enforcing.
I can use adb shell setenforce 1 to make SElinux enforcing. But after reboot, SElinux status still return to Permissive.
Is there any way to make SElinux always be Enforcing?
See this answer and this issue for details on how SELinux is enforced on Android. In short it depends on cmdline parameters of kernel and build configuration of init.
Check on your device:
~# cat /proc/cmdline
It must contain androidboot.selinux=permissive. You need to remove this parameter from kernel cmdline permanently in order to enforce SELinux on boot. This can be done by unpacking boot.img, modifying, repacking and re-flashing. Use AIK or magiskboot. Or you can also try Kernel Selinux Patcher.
But make sure you have a working sepolicy on your device or you may get into bootloop. Custom ROMs are usually userdebug builds with incomplete policy.
Q & A