$ getenforce Enforcing
$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28
パーミッシブモードはアクセス拒否はしないが、拒否のログを記録するモードである。
$ sudo setenforce 0
エンフォースモードに戻すには 1 を指定する。
$ sudo setenforce 1
$ sudo vi /etc/selinux/config
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. # See also: # https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/#getting-started-with-selinux-selinux-states-and-modes # # NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also # fully disable SELinux during boot. If you need a system with SELinux # fully disabled instead of SELinux running with no policy loaded, you # need to pass selinux=0 to the kernel command line. You can use grubby # to persistently set the bootloader to boot with selinux=0: # # grubby --update-kernel ALL --args selinux=0 # # To revert back to SELinux enabled: # # grubby --update-kernel ALL --remove-args selinux # #SELINUX=enforcing SELINUX=disabled # SELINUXTYPE= can take one of these three values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
設定を反映させるためには再起動する必要がある。
$ sudo reboot
CentOS
$ sudo yum remove selinux-policy selinux-policy-targeted
CentOS 7
$ sudo yum remove selinux-policy selinux-policy-targeted $ sudo yum remove policycoreutils
※ Gnome デスクトップでは policycoreutils を削除できない。
Fedora
$ sudo dnf remove selinux-policy selinux-policy-targeted \ setroubleshoot setroubleshoot-plugins setroubleshoot-server \ policycoreutils-python $ sudo dnf remove policycoreutils
※ Gnome デスクトップでは policycoreutils を削除できない。