Show Table of Contents
4.5. Changing SELinux Modes at Boot Time
On boot, you can set several kernel parameters to change the way SELinux runs:
- enforcing=0
- Setting this parameter causes the machine to boot in permissive mode, which is useful when troubleshooting issues. Using permissive mode might be the only option to detect a problem if your file system is too corrupted. Moreover, in permissive mode the system continues to create the labels correctly. The AVC messages that are created in this mode can be different than in enforcing mode. In permissive mode, only the first denial is reported. However, in enforcing mode you might get a denial on reading a directory and an application stops. In permissive mode, you get the same AVC message, but the application continues reading files in the directory and you get an AVC for each denial in addition.
- selinux=0
- This parameter causes the kernel to not load any part of the SELinux infrastructure. The init scripts notice that the system booted with the
selinux=0parameter and touch the/.autorelabelfile. This causes the system to automatically relabel the next time you boot with SELinux enabled.Important
Red Hat does not recommend using theselinux=0parameter. To debug your system, prefer using permissive mode. - autorelabel=1
- This parameter forces the system to relabel similarly to the following commands:
~]#
If the system labeling contains a large amount of errors, you might need to boot in permissive mode in order that the autorelabel succeeds.touch /.autorelabel~]#reboot
For additional SELinux-related kernel boot parameters, such as
checkreqprot, see the /usr/share/doc/kernel-doc-<KERNEL_VER>/Documentation/kernel-parameters.txt file. This documentation is installed with the kernel-doc package. Replace the <KERNEL_VER> string with the version number of the installed kernel, for example:
~]#yum install kernel-doc~]$less /usr/share/doc/kernel-doc-3.10.0/Documentation/kernel-parameters.txt
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.