How to Disable or set SELinux to Permissive mode [ID 457458.1]

msdnchina發表於2011-10-10
Linux

Applies to:

Linux OS - Version: Enterprise Linux 4.0 to Oracle Linux 5.0 - Release: RHEL4 to OL5
Linux x86
Linux x86-64
Linux Kernel - Version: 4.0 to 5.0

Goal

How to fully disable SELinux (Security Enhanced Linux); or set it to "permissive" mode, in which case the SELinux software is loaded, but no enforcing is made of the rules, only logging is performed.


Please note that disabling SELinux or setting to "permissive" mode may have some security considerations. It is possible to keep SELinux enabled, and add manual exclusion rules.

Solution

To completely disable SELinux, use either of these methods:

1. Edit /etc/selinux/config
  • Change the SELINUX value to "SELINUX=disabled".
  • Reboot the server.
2. Append kernel boot options
  • Edit the kernel boot line and append "selinux=0" to the kernel boot options. For example:
title Red Hat Enterprise Linux AS (2.6.9-42.ELsmp)
root (hd0,0)
kernel /vmlinuz-2.6.9-42.ELsmp ro root=LABEL=/ rhgb quiet selinux=0
initrd /initrd-2.6.9-42.ELsmp.img
  • Reboot the server.

To set SELinux to Permissive mode, use either of these methods:

1. Edit /etc/selinux/config
  • Change the SELINUX value to "SELINUX=permissive".
  • Reboot the server.
2. Append kernel boot options
  • Edit the kernel boot line and append "enforcing=0" to the kernel boot options (Assuming SELinux is not set to disabled as in section above). For example:
title Red Hat Enterprise Linux AS (2.6.9-42.ELsmp)
root (hd0,0)
kernel /vmlinuz-2.6.9-42.ELsmp ro root=LABEL=/ rhgb quiet enforcing=0
initrd /initrd-2.6.9-42.ELsmp.img
  • Reboot the server.

To check the status of SELinux, issue:

# /usr/sbin/sestatus

See for more details on checking SELinux status. [@more@]

來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/161195/viewspace-1055555/，如需轉載，請註明出處，否則將追究法律責任。

相關文章