Knowledgebase

Introduction

Security-Enhanced Linux (SELinux) adds policy-based security to the CentOS Linux kernel. System administrators set SELinux policy rules to specify access controls to processes, users, and files. By default, SELinux denies access to objects if no policy rule explicitly allows access.

Perform these steps as a sudo-enabled user, or root. This guide has been tested on:

• CentOS 8
• CentOS 7
• CentOS 6

About SELinux Modes

SELinux operates in one of three modes:

• Enforcing: SELinux controls access through policy rules.
• Permissive: SELinux only logs actions that would have been denied.
• Disabled: SELinux is disabled and does not create logs.

We recommend using SELinux in enforcing mode. If your application is not compatible with SELinux, you may need to disable it completely.

Check SELinux Status

Check the status of SELinux:

$ sudo sestatus

Find the lines relevant to this tutorial with grep:

$ sudo sestatus | grep 'SELinux status\|Current mode'

SELinux status:                 enabled
Current mode:                   enforcing

Temporarily Disable SELinux

To temporarily disable SELinux, use setenforce.

$ sudo setenforce 0
$ sudo sestatus | grep 'SELinux status\|Current mode'
SELinux status:                 enabled
Current mode:                   permissive

Notice that Current mode is now permissive. This change will only persist until the next reboot.

Permanently Disable SELinux

To disable SELinux and make it persist across reboots, edit /etc/selinux/config.

$ sudo nano /etc/selinux/config

Change the SELINUX directive with either permissive or disabled.

SELINUX=disabled

Save and exit the file, then reboot.

$ sudo shutdown -r now

After the reboot, check the status.

$ sudo sestatus
SELinux status:                 disabled

Related Documentation

• How to Enable or Reinstall SELinux on CentOS
• The official CentOS SELinux How To
• SELinux Project Wiki