Can't re-enable selinux

I need to re-enable selinux on a bunch of workstations that has had it disabled for a long time.
Permissions on /etc/selinux/config are 644 root:root.
When I try to change the SELINUX= line from disabled to enforcing, it gives me a "read only" error and won't let me save it, even though, as root, I'm supposed to be able to write to the file.
This is on RHEL 6.9.
Any ideas?