How to Disable SELinux

How to Disable SELinux

You've setup a new system, or installed something new on your Linuxsystem and its not working. You get the feeling that SELinux is thecause of the problem. This page was written to help.

Contents

       Overview
       Should you really disable SELinux?
       Temporarily switch off enforcement
       Permanently Permissive
       Fully Disabling SELinux
       Re-Enabling SELinux

Overview

SELinux has two major components on your system. There's the kernelmechanism which is enforcing a bunch of access rules which apply toprocesses and files. And secondly, there's file labels : everyfile on your system has extra labels attached to it which tie-in withthose access rules. Run ls -Z and you'll see what I mean.

Should you really disable SELinux?

Be aware that by disabling SELinux you will be removing a securitymechanism on your system. Think about this carefully, and if yoursystem is on the Internet and accessed by the public, then think aboutit some more. Joshua Brindle (an SELinux developer) has comments ondisabling SELinux here,which states clearly that applications should be fixed to work withSELinux, rather than disabling the OS security mechanism.
You need to decide if you want to disable SELinux temporarily totest the problem, or permanently switch it off. It may also be abetter option to make changes to the policy to permit the operationsthat are being blocked - but this requires knowledge of writingpolicies and may be a steep learning curve for some people.For the operating system as a whole, there is two kinds of disabling:

• Permissive - switch the SELinux kernel into a mode whereevery operation is allowed. Operations that would be denied areallowed and a message is logged identifying that it would bedenied. The mechanism that defines labels for files which are beingcreated/changed is still active.
• Disabled - SELinux is completely switched off in the kernel. Thisallows all operations to be permitted, and also disables the processwhich decides what to label files & processes with.

Disabling SELinux could lead to problems if you want to re-enable itagain later. When the system runs with file labelling disable it willcreate files with no label - which could cause problems if the systemis booted into Enforcement mode. A full re-labelling of the filesystem will be necessary.

Temporarily switch off enforcement

You can switch the system into permissive mode with the following command:

echo 0 >/selinux/enforce

You'll need to be logged in as root, and in the sysadm_r role:

newrole -r sysadm_r

To switch back into enforcing mode:

echo 1 >/selinux/enforce

In Fedora Core and RedHat Enterprise Linux you can use the setenforce command with a 0 or 1 option toset permissive or enforcing mode, its just a slightly easier commandthan the above.

To check what mode the system is in,

cat /selinux/enforce

which will print a "0" or "1" for permissive or enforcing - probablyprinted at the beginning of the line of the command prompt.

Permanently Permissive

The above will switch off enforcement temporarily - until you rebootthe system. If you want the system to always start in permissive mode,then here is how you do it.

In Fedora Core and RedHat Enterprise, edit /etc/selinux/config and you will see some lines like this:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

... just change SELINUX=enforcing to SELINUX=permissive, and you're done. Reboot if you want to prove it.

For the other Linuxes which don't have the /etc/selinux/config file, you just need to edit the kernel boot line, usually in /boot/grub/grub.conf if you're using the GRUB boot loader. On the kernel line, add enforcing=0 at the end. For example,

title SE-Linux Test System
	root (hd0,0)
	kernel /boot/vmlinuz-2.4.20-selinux-2003040709 ro root=/dev/hda1 nousb enforcing=0
	#initrd /boot/initrd-2.4.20-selinux-2003040709.img

Fully Disabling SELinux

Fully disabling SELinux goes one step further than just switching intopermissive mode. Disabling will completely disable all SELinuxfunctions including file and process labelling.

In Fedora Core and RedHat Enterprise, edit /etc/selinux/config and change the SELINUX line to SELINUX=disabled:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

... and then reboot the system.

For the other Linuxes which don't have the /etc/selinux/config file, you just need toedit the kernel boot line, usually in /boot/grub/grub.conf, if you're using theGRUB boot loader. On the kernel line, add selinux=0 at the end. For example,

title SE-Linux Test System
        root (hd0,0)
        kernel /boot/vmlinuz-2.4.20-selinux-2003040709 ro root=/dev/hda1 nousb selinux=0
        #initrd /boot/initrd-2.4.20-selinux-2003040709.img

You will have to reboot to disable SELinux, you just can't do it while the system is running.

Re-Enabling SELinux

If you've disabled SELinux as in the section above, and you want toenable it again then you've got a bit of work to do. The problem willbe that files created or changed when SELinux was disabled won't havethe correct file labels on them - if you just reboot in enforcing mode thena lot of stuff won't work properly.

What you need to do is to enable SELinux by editing /etc/selinux/config (for Fedora/RedHat) or by adding selinux=1 to the kernel boot line, then boot into permissive mode, thenrelabel everything, and then reboot into (or simply switch to)enforcing mode.

After booting into permissive mode, runfixfiles relabel

Alternatively, in Fedora and RedHat Enterprise Linux you can runtouch /.autorelabeland reboot or put autorelabelon the boot command line - in both cases the file system gets a fullrelabel early in the boot process. Note that this can take quite sometime for systems with a large number of files.

After relabelling the filesystem, you can switch to enforcingmode (see above) and your system should be fully enforcing again.