mirror of
https://pagure.io/fedora-docs/quick-docs.git
synced 2024-10-19 01:35:42 +00:00
65925232d5
The kernel functionality that allowed to disable SELinux by changing /etc/selinux/config is now deprecated and will be removed in F34 [1]. While setting SELINUX=Disabled will still lead to a similar state even after the removal, it is better to guide users to disable SELinux via kernel boot parameters, which will actually disable SELinux completely (as in no SElinux code is executed by the kernel). [1] https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
46 lines
1.8 KiB
Text
46 lines
1.8 KiB
Text
// Module included in the following assemblies:
|
|
//
|
|
// changing-selinux-states-and-modes.adoc
|
|
|
|
[#{context}-enabling-selinux]
|
|
= Enabling SELinux
|
|
|
|
When enabled, SELinux can run in one of two modes: enforcing or permissive. The following sections show how to permanently change into these modes.
|
|
|
|
While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, follow this procedure:
|
|
|
|
. In case your system has SELinux disabled at the kernel level (this is the recommended way, see <<{context}-disabling-selinux>>), make sure to undo that first.
|
|
|
|
.. Check if you have `selinux=0` in your kernel command line:
|
|
+
|
|
[subs="quotes"]
|
|
----
|
|
~]$ cat /proc/cmdline
|
|
_[...]_ rd.lvm.lv=fedora/swap rhgb quiet *selinux=0*
|
|
----
|
|
|
|
.. If it is there, remove it from the bootloader configuration using [command]`grubby`:
|
|
+
|
|
----
|
|
~]# grubby --update-kernel ALL --remove-args selinux
|
|
----
|
|
|
|
.. The change will be applied after you reboot the system (see below).
|
|
|
|
. Enable SELinux in permissive mode. For more information, see <<{context}-changing-to-permissive-mode>>.
|
|
|
|
. Reboot your system.
|
|
|
|
. Check for SELinux denial messages.
|
|
// For more information, see <<Fixing_Problems-Searching_For_and_Viewing_Denials>>.
|
|
|
|
. If there are no denials, switch to enforcing mode. For more information, see <<{context}-changing-to-enforcing-mode>>.
|
|
|
|
To run custom applications with SELinux in enforcing mode, choose one of the following scenarios:
|
|
|
|
* Run your application in the `unconfined_service_t` domain.
|
|
// See <<Targeted_Policy-Unconfined_Processes>> for more information.
|
|
|
|
* Write a new policy for your application. See the link:++https://access.redhat.com/solutions/117583++[Writing Custom SELinux Policy] Knowledgebase article for more information.
|
|
|
|
// Temporary changes in modes are covered in <<{context}-selinux-states-and-modes>>.
|