How to Permanently Disable SELinux in CentOS 8

by
Share on Social Media

Learn how to permanently disable SELinux in CentOS 8 with this step-by-step guide. Follow our instructions to modify SELinux configuration files and ensure it remains disabled across system reboots. #centlinux #linux #selinux

What is SELinux?

SELinux (Security-Enhanced Linux) is a Linux kernel module that provides a mechanism to enforce access control security policies including MAC (Mandatory Access Control).

SELinux adds another layer of security to the Linux server by allowing system administrators to control access to operating system objects based on rules based policies.

In CentOS 8 operating system, SELinux runs by-default in enforcing mode with targeted policy.

Although it is not recommended to disable SELinux but there are situations where we need to disable it explicitly. For example when we are installing a software that does not support SELinux.

Read Also: How to Permanently Disable SELinux in Rocky Linux 9

SELinux Operating Modes:

SELinux has three modes of operations.

  • Enforcing: It is the default mode. Access is granted based on SELinux policies.
  • Permissive: In this mode SELinux does not restrict access to any objects. Besides that it only logs violations of SELinux policies. This mode is good for debugging purposes.
  • Disabled: Neither SELinux policy is enforced nor any messages are logged.

SELinux Features:

Some of the SELinux features are.

  • Well-defined policy interfaces
  • Support for applications querying the policy and enforcing access control (for example, crond running jobs in the correct context)
  • Individual labels and controls for kernel objects and services
  • Separate measures for protecting system integrity (domain-type) and data confidentiality (multilevel security)
  • Controls over process initialization and inheritance, and program execution
  • Controls over file systems, directories, files, and open file descriptors
  • Controls over sockets, messages, and network interfaces
  • Default-deny policy (anything not explicitly specified in the policy is disallowed)

Recommended Online Training: Learn Bash Shell in Linux for Beginners

745772 0021

Check SELinux Status

SELinux is by-default enabled on all installations of CentOS 8 operating system. But it can be disabled explicitly by a System Administrator.

We can run getenforce command, to check the current mode of SELinux.

# getenforce
Enforcing

To check the detailed status of the SELinux on the server, we can use following Linux command.

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31

Temporarily Set SELinux mode

We can temporarily (uptill next system reboot) switch SELinux modes between enforcing and permissive.

Permissive mode is good for generating SELinux security violation logs to create a custom SELinux policy.

Permissive mode is also useful to check if SELinux is blocking access to our processes or files in enforcing mode (e.g. we have configured an Apache web server on a custom port and it is not working).

Following Linux command is used to change SELinux mode to permissive.

# setenforce 0

Check current mode of SELinux again.

# getenforce
Permissive

Change SELinux mode back to enforcing.

# setenforce 1

Permanently Set SELinux mode

If we require to set SELinux mode permanently to permissive then we have to set it in SELinux configuration file as well. So, on the next boot the SELinux will start in permissive mode.

# sed -i s/^SELINUX=.*$/SELINUX=permissive/ /etc/selinux/config
# setenforce 0

Permanently Disable SELinux in CentOS 8

It is not possible to disable SELinux temporarily while a CentOS server is running. We must disable SELinux via its configuration file, so on next system reboot the SELinux won’t be enable anymore.

# sed -i s/^SELINUX=.*$/SELINUX=disabled/ /etc/selinux/config
# systemctl reboot

After reboot, check the current status of SELinux.

# sestatus
SELinux status:                 disabled

SELinux has been permanently disabled on our CentOS 8 server.

If you are new to Linux and facing difficulty in working at Linux Bash prompt. We recommend that, you should read The Linux Command Line, 2nd Edition: A Complete Introduction by William Shotts.

Conclusion

In this guide, you have learned how to permanently disable SELinux in CentOS 8.

Leave a Comment