Knowledgebase

How to Disable SELinux on CentOS Print

  • 0

Introduction

Security-Enhanced Linux (SELinux) adds policy-based security to the CentOS Linux kernel. System administrators set SELinux policy rules to specify access controls to processes, users, and files. By default, SELinux denies access to objects if no policy rule explicitly allows access.

Perform these steps as a sudo-enabled user, or root. This guide has been tested on:

  • CentOS 8
  • CentOS 7
  • CentOS 6

About SELinux Modes

SELinux operates in one of three modes:

  • Enforcing: SELinux controls access through policy rules.
  • Permissive: SELinux only logs actions that would have been denied.
  • Disabled: SELinux is disabled and does not create logs.

We recommend using SELinux in enforcing mode. If your application is not compatible with SELinux, you may need to disable it completely.

Check SELinux Status

Check the status of SELinux:

$ sudo sestatus

Find the lines relevant to this tutorial with grep:

$ sudo sestatus | grep 'SELinux status\|Current mode'

SELinux status:                 enabled
Current mode:                   enforcing

Temporarily Disable SELinux

To temporarily disable SELinux, use setenforce.

$ sudo setenforce 0
$ sudo sestatus | grep 'SELinux status\|Current mode'
SELinux status:                 enabled
Current mode:                   permissive

Notice that Current mode is now permissive. This change will only persist until the next reboot.

Permanently Disable SELinux

To disable SELinux and make it persist across reboots, edit /etc/selinux/config.

$ sudo nano /etc/selinux/config

Change the SELINUX directive with either permissive or disabled.

SELINUX=disabled

Save and exit the file, then reboot.

$ sudo shutdown -r now

After the reboot, check the status.

$ sudo sestatus
SELinux status:                 disabled
Introduction Security-Enhanced Linux (SELinux) adds policy-based security to the CentOS Linux kernel. System administrators set SELinux policy rules to specify access controls to processes, users, and files. By default, SELinux denies access to objects if no policy rule explicitly allows access. Perform these steps as a sudo-enabled user, or root. This guide has been tested on: CentOS 8 CentOS 7 CentOS 6 About SELinux Modes SELinux operates in one of three modes: Enforcing: SELinux controls access through policy rules. Permissive: SELinux only logs actions that would have been denied. Disabled: SELinux is disabled and does not create logs. We recommend using SELinux in enforcing mode. If your application is not compatible with SELinux, you may need to disable it completely. Check SELinux Status Check the status of SELinux: $ sudo sestatus Find the lines relevant to this tutorial with grep: $ sudo sestatus | grep 'SELinux status\|Current mode' SELinux status: enabled Current mode: enforcing Temporarily Disable SELinux To temporarily disable SELinux, use setenforce. $ sudo setenforce 0 $ sudo sestatus | grep 'SELinux status\|Current mode' SELinux status: enabled Current mode: permissive Notice that Current mode is now permissive. This change will only persist until the next reboot. Permanently Disable SELinux To disable SELinux and make it persist across reboots, edit /etc/selinux/config. $ sudo nano /etc/selinux/config Change the SELINUX directive with either permissive or disabled. SELINUX=disabled Save and exit the file, then reboot. $ sudo shutdown -r now After the reboot, check the status. $ sudo sestatus SELinux status: disabled Related Documentation How to Enable or Reinstall SELinux on CentOS The official CentOS SELinux How To SELinux Project Wiki

Was this answer helpful?
Back

Powered by WHMCompleteSolution