Docs/quick-docs
1
0
Fork 0
Code Issues 48 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix proc_disabling-selinux

Browse source
This commit is contained in:
Mirek Jahoda 2020-11-09 16:56:49 +01:00 • committed by pbokoc
parent 2bbce8f88b
commit 1ca1b37fd4
3 changed files with 37 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/ROOT/pages/_partials/proc_changing-to-enforcing-mode.adoc
View file

@ -7,6 +7,8 @@
When SELinux is running in enforcing mode, it enforces the SELinux policy and denies access based on SELinux policy rules. In Fedora, enforcing mode is enabled by default when the system was initially installed with SELinux.
.Procedure
. Check the current SELinux mode by using the [command]`getenforce` command:
+
[subs="quotes"]

9
modules/ROOT/pages/_partials/proc_changing-to-permissive-mode.adoc
View file

@ -7,7 +7,9 @@
When SELinux is running in permissive mode, SELinux policy is not enforced. The system remains operational and SELinux does not deny any operations but only logs AVC messages, which can be then used for troubleshooting, debugging, and SELinux policy improvements. Each AVC is logged only once in this case.
To permanently change mode to permissive, follow the procedure below:
.Procedure
To permanently change mode to permissive:
. Edit the `/etc/selinux/config` file as follows:
+
@ -25,8 +27,9 @@ SELINUX=*permissive*
SELINUXTYPE=targeted
----
. Reboot the system:
. Restart the system:
+
[subs="quotes"]
----
~]# reboot
$ *reboot*
----

42
modules/ROOT/pages/_partials/proc_disabling-selinux.adoc
View file

@ -5,31 +5,47 @@
[#{context}-disabling-selinux]
= Disabling SELinux
When SELinux is disabled, SELinux policy is not loaded at all; it is not enforced and AVC messages are not logged. Therefore, all benefits of running SELinux listed in link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/chap-security-enhanced_linux-introduction#sect-Security-Enhanced_Linux-Introduction-Benefits_of_running_SELinux[Benefits of SELinux] are lost.
When SELinux is disabled, SELinux policy is not loaded at all; it is not enforced and AVC messages are not logged. Therefore, all benefits of running SELinux listed in link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux#benefits-of-selinux_getting-started-with-selinux[Benefits of SELinux] are lost.
[IMPORTANT]
====
It is recommended to use permissive mode instead of permanently disabling SELinux. See <<{context}-changing-to-permissive-mode>> for more information about permissive mode.
It is recommended to use permissive mode instead of permanently disabling SELinux. See xref:{context}-changing-to-permissive-mode[] for more information about permissive mode.
====
To permanently disable SELinux, follow the procedure below:
.Prerequisites
This procedure assumes that the [package]*grubby* package is installed. To verify that it is installed, use the following command:
[subs="quotes"]
----
~]$ rpm -q grubby
----
. Configure your bootloader to add `selinux=0` to the kernel command-line:
* The [package]`grubby` package is installed:
+
[subs="quotes"]
----
~]# grubby --update-kernel ALL --args selinux=0
$ *rpm -q grubby*
grubby-_version_
----
. Reboot your system. After reboot, confirm that the [command]`getenforce` command returns `Disabled`:
.Procedure
To permanently disable SELinux:
. Configure your bootloader to add `selinux=0` to the kernel command line:
+
[subs="quotes"]
----
~]$ getenforce
$ *sudo grubby --update-kernel ALL --args selinux=0*
----
. Restart your system:
+
[subs="quotes"]
----
$ *reboot*
----
.Verification step
* After reboot, confirm that the [command]`getenforce` command returns `Disabled`:
+
[subs="quotes"]
----
$ *getenforce*
Disabled
----