Why does SELinux get disabled when flashing a patched Magisk recovery?
Doing a bit more testing and the terminal actually shows SELinux in permissive state, but this can be set to enforcing again. Either way, when in permissive, it still trips Lineage Trust to show SELinux as disabled, weird.
edit: nope, when I enable Magisk for the first time using the recovery key combo it seems to permanently break SELinux into disabled/permissive state - I have to do a factory reset and never install Magisk to fix it. Has anyone got any ideas?
fixed: in case anyone reads the OP and thinks you need to patch the recovery to use Magisk - you don't, just flash it straight from stock TWRP and SELinux works correctly. When booted into the ROM, open Magisk Manager, allow it to install the full version, ignore the "additional setup" stuff, reboot and you will have Magisk + SELinux enforcing.
This applies if coming from the Stock Samsung ROM.
Also, the T720XXU1CTK1 firmware is buggy, volume buttons don't work and rotation sensor fails. Stick to T720XXU1CTI1 until the new firmware is patched into the ROM - this was with a clean install.