Question : How to fully disable SELinux (Security Enhanced Linux) or set it to “permissive” mode
Answer :
SELinux gives that extra layer of security to the resources in the system. It provides the MAC (mandatory access control) as contrary to the DAC (Discretionary access control). Before we dive into setting the SELinux modes, let us see what are the different SELinux modes of operation and how do they work. SELinux can operate in any of the 3 modes :
1. Enforced : Actions contrary to the policy are blocked and a corresponding event is logged in the audit log.
2. Permissive : Actions contrary to the policy are only logged in the audit log.
3. Disabled : The SELinux is disabled entirely.
To completely disable SELinux, use either of these methods:
1. Edit /etc/selinux/config (reboot required)
Change the SELINUX value to SELINUX=disabled in the file /etc/selinux/config.
# cat /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of three two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
Reboot the server.
# shutdown -r now
2. Append kernel boot options
Edit the kernel boot line in /boot/grub/grub.conf and append selinux=0 to the kernel boot options. For example:
title Red Hat Enterprise Linux AS (2.6.9-42.ELsmp) root (hd0,0) kernel /vmlinuz-2.6.9-42.ELsmp ro root=LABEL=/ rhgb quiet selinux=0 initrd /initrd-2.6.9-42.ELsmp.img
Reboot the server.
# shutdown -r now
To set SELinux to Permissive mode, use either of these methods:
1. Set SELinux mode to Permissive temporary (without reboot)
The setenforce command is used to change between enforcing and permissive mode. To change to permissive mode:
# setenforce 0
Use the getenforce command to view current SELinux mode:
# getenforce Permissive
2. Setting SELinux to Permissive mode permanently
a. Edit /etc/selinux/config
Change the SELINUX value to “SELINUX=permissive”
# cat /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=permissive # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
b. Append kernel boot options
Edit the kernel boot line and append “enforcing=0” to the kernel boot options (Assuming SELinux is not set to disabled as in section above). For example:
title Red Hat Enterprise Linux AS (2.6.9-42.ELsmp) root (hd0,0) kernel /vmlinuz-2.6.9-42.ELsmp ro root=LABEL=/ rhgb quiet enforcing=0 initrd /initrd-2.6.9-42.ELsmp.img
Reboot the server.
# shutdown -r now
To check the status of SELinux, issue:
# sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28