How to permanently disable SELinux

1. Introduction to SELinux

Linux is considered to be one of the most secure operating systems today because of its outstanding security features, such as SELinux (Security Enhanced Linux).

For starters, SELinux is described as a mandatory access control (MAC) security structure implemented in the kernel. SELinux provides a way to enforce certain security policies, otherwise system administrators will not be able to effectively implement these policies. When you install RHEL/CentOS or other derivatives, the SELinux service is enabled by default, so some applications on your system may not support this security mechanism. Therefore, in order for such applications to run normally, SELinux must be disabled or closed.

SELinux has 3 states, namely Enforcing, Permissive and Disabled states. The first is the default state, which means that it is mandatory, and the second is forgiving, that is, most of the rules are allowed. The third is to disable, that is, do not set any rules. The first two states can only be set through the setenforce command, and if you want to change to the disabled state, you need to modify the configuration file and restart the system at the same time.

The first thing to do is to check the status of SELinux on the system, which can be done by running the following command :

sestatus
getenforce

As shown below:

：

Second, temporarily disable SELinux

echo 0 > /selinux/enforce
setenforce 0
setenforce Permissive

 

3. Permanently disable SELinux

1. Open the /etc/sysconfig/selinux file

vi /etc/sysconfig/selinux

2. Change the configuration SELinux=enforcing to SELinux=disabled

SELINUX=disabled

3. Save and exit the file. In order to make the configuration effective, you need to restart the system, and then use the sestatus command to check the status of SELinux

getenforce
reboot #重启电脑

Four, principle and attention

The permissions of linux adopt the file-user-user group model. The user who created the file has all the permissions of the file. Once a user is breached, the risk of the system increases infinitely.

Selinux is different. The administrator creates security rules to control resource access. For example, it defines which files and directories can be accessed by the http process. Even if root has all the file modification and access permissions, it violates the administrator's application rules. Inaccessible, of course the configuration will be more complicated. Redhat has already integrated some commonly used applications.