All three modes block denied operations equally

Enforcing blocks and logs policy denials, Permissive logs without blocking, and Disabled loads no SELinux policy

Permissive turns off denial logging but keeps blocking

Disabled loads the policy only for auditing