Function selinux_ensure_install_or_setenforce 

pub(crate) fn selinux_ensure_install_or_setenforce(
    reexec_env: &[(&str, &str)],
) -> Result<Option<SetEnforceGuard>>

Try to enter the install_t domain, but if we can’t do that, then just setenforce 0.