def get_selinux_status():
    """
    get SELinux status of host

    :return: string, one of Enforced, Permissive, Disabled
    """
    getenforce_command_exists()
    # alternatively, we could read directly from /sys/fs/selinux/{enforce,status}, but status is
    # empty (why?) and enforce doesn't tell whether SELinux is disabled or not
    o = run_cmd(["getenforce"], return_output=True).strip()  # libselinux-utils
    logger.debug("SELinux is %r", o)
    return o
get SELinux status of host

    :return: string, one of Enforced, Permissive, Disabled