RHCSA Rapid Track

Objectives

After completing this section, students should be able to:

For troubleshooting purposes, SELinux protection can be temporarily disabled using SELinux modes. This section will look at how to change SELinux modes temporarily between enforcing and permissive mode. It will also look at how to set the default SELinux mode that is determined at boot time.

Changing the current SELinux mode

The setenforce command modifies the current SELinux mode:

[root@serverX ~]# getenforce
Enforcing
[root@serverX ~]# setenforce
usage:  setenforce [ Enforcing | Permissive | 1 | 0 ]
[root@serverX ~]# setenforce 0
[root@serverX ~]# getenforce
Permissive
[root@serverX ~]# setenforce Enforcing
[root@serverX ~]# getenforce
Enforcing

Another way to temporarily set the SELinux mode is to pass a parameter to the kernel at boot time. Passing a kernel argument of enforcing=0 causes the system to boot into permissive mode. A value of 1 would specify enforcing mode. SELinux can be disabled when the selinux=0 argument is specified. A value of 1 would enable SELinux.

Setting the default SELinux mode

The configuration file that determines what the SELinux mode is at boot time is /etc/selinux/config. Notice that it contains some useful comments:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes
#               are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Use /etc/selinux/config to change the default SELinux mode at boot time. In the example shown, it is set to enforcing mode.

Passing the selinux= and/or the enforcing= kernel arguments overrides any of the default values specified in /etc/selinux/config.