Android's SELinux implementation is in enforcing mode - rather than the non-functional disabled mode or the notification-only permissive mode - to act as a reference and facilitate testing and development. Although enforcing mode is set globally, please remember this can be overridden on a per-domain basis as is in the case of the application domain.
SELinux for Android is accompanied by everything you need to enable SELinux now. You merely need to integrate the latest Android kernel and then incorporate the files found in the ~platform/external/sepolicy directory (where examples can also be found):
https://android.googlesource.com/kernel/common/
https://android.googlesource.com/platform/external/sepolicy/
Those files when compiled comprise the SELinux kernel security policy and cover the upstream Android operating system. Place those files within the /device/manufacturer/device-name/sepolicy directory.
Then just update your BoardConfig.mk makefile - located in the directory containing the sepolicy subdirectory - to reference the sepolicy subdirectory once created, like so:
BOARD_SEPOLICY_DIRS := \
<root>/device/manufacturer/device-name/sepolicy
BOARD_SEPOLICY_UNION := \
genfs_contexts \
file_contexts \
sepolicy.te
After rebuilding your device, it is enabled with SELinux. You can now either customize your SELinux policies to accommodate your own additions to the Android operating system as described in the Customization section or verify your existing setup as covered in the Validation section.