Fix exec to set the mode

if selinux is currently disabled on the system, this exec will continue to trigger. Grep needs to check for disabled as well - we cant transition from disabled to enforcing, so that prevents the exec from triggering.