Changing SELinux states and modes

As discussed in Introduction to SELinux, SELinux can be enabled or disabled. When enabled, SELinux has two modes: enforcing and permissive.

Use the or sestatus commands to check in which mode SELinux is running. The getenforce command returns Enforcing, Permissive, or Disabled.

The sestatus command returns the SELinux status and the SELinux policy being used:

When enabled, SELinux can run in one of two modes: enforcing or permissive. The following sections show how to permanently change into these modes.

While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, follow this procedure.

Prerequisites

The selinux-policy-targeted, selinux-policy, libselinux-utils, and grubby packages are installed. To check that a particular package is installed:
```
$ rpm -q package_name
```

Procedure

If your system has SELinux disabled at the kernel level (this is the recommended way, see ), change this first. Check if you have the selinux=0 option in your kernel command line:
```
$ cat /proc/cmdline
BOOT_IMAGE=... ... selinux=0
```
1. Remove the selinux=0 option from the bootloader configuration using grubby:
```
$ sudo grubby --update-kernel ALL --remove-args selinux
```
2. The change applies after you restart the system in one of the following steps.
Ensure the file system is relabeled on the next boot:
```
$ sudo fixfiles onboot
```
Enable SELinux in permissive mode. For more information, see Changing to permissive mode.
Restart your system:
```
$ reboot
```
Check for SELinux denial messages.

Run your application in the unconfined_service_t domain.
Write a new policy for your application. See the chapter in the RHEL 8 Using SELinux document for more information.

When SELinux is running in permissive mode, SELinux policy is not enforced. The system remains operational and SELinux does not deny any operations but only logs AVC messages, which can be then used for troubleshooting, debugging, and SELinux policy improvements. Each AVC is logged only once in this case.

Procedure

To permanently change mode to permissive:

Edit the /etc/selinux/config file as follows:


# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#       targeted - Targeted processes are protected,
#       mls - Multi Level Security protection.
SELINUXTYPE=targeted

Restart the system:
```
$ reboot
```

Changing to enforcing mode

When SELinux is running in enforcing mode, it enforces the SELinux policy and denies access based on SELinux policy rules. In Fedora, enforcing mode is enabled by default when the system was initially installed with SELinux.

Procedure

Check the current SELinux mode by using the getenforce command:
```
$ getenforce
Permissive
```
If the command displays Disabled, then follow Enabling SELinux. If it displays Permissive, use the following steps to change mode to enforcing again:

Edit the /etc/selinux/config file as follows:

# This file controls the state of SELinux on the system.
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
# SELINUXTYPE= can take one of these two values:
#       targeted - Targeted processes are protected,
#       mls - Multi Level Security protection.
SELINUXTYPE=targeted

Restart the system:
```
$ reboot
```
On the next boot, SELinux relabels all files and directories in the system and adds the SELinux context for files and directories that were created when SELinux was disabled.

Prerequisites

The grubby package is installed:
```
$ rpm -q grubby
grubby-version
```

Procedure

To permanently disable SELinux:

Configure your bootloader to add selinux=0 to the kernel command line:
```
$ sudo grubby --update-kernel ALL --args selinux=0
```
Restart your system:
```
$ reboot
```

Verification step

After reboot, confirm that the getenforce command returns Disabled:
```
$ getenforce
```

On boot, you can set several kernel parameters to change the way SELinux runs:

enforcing=0

Setting this parameter causes the machine to boot in permissive mode, which is useful when troubleshooting issues. Using permissive mode might be the only option to detect a problem if your file system is too corrupted. Moreover, in permissive mode the system continues to create the labels correctly. The AVC messages that are created in this mode can be different than in enforcing mode. In permissive mode, only the first denial is reported. However, in enforcing mode you might get a denial on reading a directory and an application stops. In permissive mode, you get the same AVC message, but the application continues reading files in the directory and you get an AVC for each denial in addition.

selinux=0

This parameter causes the kernel to not load any part of the SELinux infrastructure. The init scripts notice that the system booted with the selinux=0 parameter and touch the /.autorelabel file. This causes the system to automatically relabel the next time you boot with SELinux enabled.

autorelabel=1

This parameter forces the system to relabel similarly to the following commands:

For additional SELinux-related kernel boot parameters, such as checkreqprot, see the file. This file is available in the source package of your Linux kernel (.src.rpm). To download the source package containing the currently used kernel:

~]# dnf download --source kernel