50.2.6. Enabling or Disabling Enforcement
You can enable and disable SELinux enforcement at runtime or configure it to start in the correct mode at boot time, using the command line or GUI. SELinux can operate in one of three modes: disabled , meaning not enabled in the kernel; permissive , meaning SELinux is running and logging but not controlling permissions; or enforcing , meaning SELinux is running and enforcing policy.
setenforcecommand to change between permissive and enforcing modes at runtime. Use
setenforce 0to enter permissive mode; use
setenforce 1to enter enforcing mode.
sestatuscommand displays the current mode and the mode from the configuration file referenced during boot:
sestatus | grep -i modeCurrent mode: permissive Mode from config file: permissive
Note that changing the runtime enforcement does not affect the boot time configuration:
sestatus | grep -i modeCurrent mode: enforcing Mode from config file: permissive
You can also disable enforcing mode for a single daemon. For example, if you are trying to troubleshoot the
nameddaemon and SELinux, you can turn off enforcing for just that daemon.
getseboolcommand to get the current status of the boolean:
getsebool named_disable_transnamed_disable_trans --> off
Use the following command to disable enforcing mode for this daemon:
setsebool named_disable_trans 1~]#
getsebool named_disable_transnamed_disable_trans --> on
This sets the runtime value only. Use the
-Poption to make the change persistent across reboots.
Any *_disable_trans booleans that are set to "on" invoke the conditional that prevents the process from transitioning to the domain on execution.
Use the following command to find which of these booleans are set:
getsebool -a | grep disable.*onhttpd_disable_trans=1 mysqld_disable_trans=1 ntpd_disable_trans=1
You can set any number of boolean values using the
setsebool -P httpd_disable_trans=1 mysqld_disable_trans=1 ntpd_disable_trans=1
You can also use
togglesebool <boolean_name>to change the value of a specific boolean:
getsebool httpd_disable_transhttpd_disable_trans --> off ~]#
togglesebool httpd_disable_transhttpd_disable_trans: active
You can configure all of these settings using system-config-selinux. The same configuration files are used, so changes appear bidirectionally.
Changing a Runtime Boolean
Use the following procedure to change a runtime boolean using the GUI.
Administrator privileges are required to perform this procedure.
- On the System menu, point to Administration and then click Security Level and Firewall to display the Security Level Configuration dialog box.
- Click the SELinux tab, and then click Modify SELinux Policy.
- In the selection list, click the arrow next to the Name Service entry, and select the Disable SELinux protection for named daemon check box.
- Click OK to apply the change. Note that it may take a short time for the policy to be reloaded.
Figure 50.1. Using the Security Level Configuration dialog box to change a runtime boolean.
If you want to control these settings with scripts, you can use the