mirror of
https://pagure.io/fedora-docs/quick-docs.git
synced 2024-11-24 21:35:17 +00:00
34 lines
1.9 KiB
Text
34 lines
1.9 KiB
Text
// Module included in the following assemblies:
|
||
//
|
||
// changing-selinux-states-and-modes.adoc
|
||
|
||
[#{context}-changing-selinux-modes]
|
||
= Permanent changes in SELinux states and modes
|
||
|
||
As discussed in link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/chap-security-enhanced_linux-introduction[Introduction to SELinux], SELinux can be enabled or disabled. When enabled, SELinux has two modes: enforcing and permissive.
|
||
|
||
Use the [command]`getenforce` or [command]`sestatus` commands to check in which mode SELinux is running. The [command]`getenforce` command returns `Enforcing`, `Permissive`, or `Disabled`.
|
||
|
||
The [command]`sestatus` command returns the SELinux status and the SELinux policy being used:
|
||
|
||
[source,bash]
|
||
----
|
||
~]$ sestatus
|
||
SELinux status: enabled
|
||
SELinuxfs mount: /sys/fs/selinux
|
||
SELinux root directory: /etc/selinux
|
||
Loaded policy name: targeted
|
||
Current mode: enforcing
|
||
Mode from config file: enforcing
|
||
Policy MLS status: enabled
|
||
Policy deny_unknown status: allowed
|
||
Memory protection checking: actual (secure)
|
||
Max kernel policy version: 31
|
||
----
|
||
|
||
[NOTE]
|
||
====
|
||
When systems run SELinux in permissive mode, users and processes can label various file-system objects incorrectly. File-system objects created while SELinux is disabled are not labeled at all. This behavior causes problems when changing to enforcing mode because SELinux relies on correct labels of file-system objects.
|
||
|
||
To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from the disabled state to permissive or enforcing mode. In permissive mode, use the [command]`fixfiles -F onboot` command as root to create `/.autorelabel` file containing the `-F` option to ensure that files are relabeled upon next reboot.
|
||
====
|