Introduction
Security-Enhanced Linux (SELinux) adds policy-based security to the CentOS Linux kernel. System administrators set SELinux policy rules to specify access controls to processes, users, and files. By default, SELinux denies access to objects if no policy rule explicitly allows access.
Perform these steps as a sudo-enabled user, or root. This guide has been tested on:
- CentOS 8
- CentOS 7
- CentOS 6
About SELinux Modes
SELinux operates in one of three modes:
- Enforcing: SELinux controls access through policy rules.
- Permissive: SELinux only logs actions that would have been denied.
- Disabled: SELinux is disabled and does not create logs.
We recommend using SELinux in enforcing mode. If your application is not compatible with SELinux, you may need to disable it completely.
Check SELinux Status
Check the status of SELinux:
$ sudo sestatus
Find the lines relevant to this tutorial with grep
:
$ sudo sestatus | grep 'SELinux status\|Current mode'
SELinux status: enabled
Current mode: enforcing
Temporarily Disable SELinux
To temporarily disable SELinux, use setenforce
.
$ sudo setenforce 0
$ sudo sestatus | grep 'SELinux status\|Current mode'
SELinux status: enabled
Current mode: permissive
Notice that Current mode is now permissive. This change will only persist until the next reboot.
Permanently Disable SELinux
To disable SELinux and make it persist across reboots, edit /etc/selinux/config.
$ sudo nano /etc/selinux/config
Change the SELINUX directive with either permissive or disabled.
SELINUX=disabled
Save and exit the file, then reboot.
$ sudo shutdown -r now
After the reboot, check the status.
$ sudo sestatus
SELinux status: disabled