Enable or disable SELinux on a Linux instance

Usage notes

The screenshots in this topic are based on the following images:

• Alibaba Cloud Linux 3.2104 LTS 64-bit

• CentOS 7.6 64-bit

Enable SELinux

1. Connect to the Linux ECS instance.

   See Connect to a Linux instance by using a password or key.

2. Check the SELinux status:

   sestatus

   If disabled is returned for SELinux status, SELinux is disabled.

   [root@iZ***Z ~]# sestatus
   SELinux status:                 disabled
   [root@iZ***Z ~]#

3. Open the SELinux config file:

   sudo vi /etc/selinux/config

4. Find SELINUX=disabled and press I to enter Insert mode.

   SELinux supports the following modes:

   Mode	Value	Description
   Enforcing	SELINUX=enforcing	Denies all requests that violate SELinux policy.
   Permissive	SELINUX=permissive	Logs policy violations without denying requests.

   The current configuration file shows SELINUX=disabled, indicating that SELinux is disabled. Change this value to the target mode.

   # This file controls the state of SELinux on the system.
   # SELINUX= can take one of these three values:
   #     enforcing - SELinux security policy is enforced.
   #     permissive - SELinux prints warnings instead of enforcing.
   #     disabled - No SELinux policy is loaded.
   SELINUX=disabled
   # SELINUXTYPE= can take one of three values:
   #     targeted - Targeted processes are protected,
   #     minimum - Modification of targeted policy. Only selected processes are protected.
   #     mls - Multi Level Security protection.
   SELINUXTYPE=targeted

5. Press Esc, enter :wq, and press Enter to save and close the file.

   Important

   After modifying the config file, you must restart the instance for changes to take effect. To prevent boot failure, create an .autorelabel file before restarting.

6. Create the .autorelabel file in the root directory:

   sudo touch /.autorelabel

7. Restart the ECS instance. See Restart an instance.

   Note

   During restart, SELinux automatically relabels all system files. This process may take time depending on the number and size of files. Do not operate the instance until relabeling completes.

Disable SELinux

1. Connect to the Linux ECS instance.

   See Connect to a Linux instance by using a password or key.

2. Check the SELinux status:

   sestatus

   If enabled is returned for SELinux status, SELinux is enabled.

   [testuser@iZ xxx Z ~]$ sestatus
   SELinux status:                 enabled
   SELinuxfs mount:                /sys/fs/selinux
   SELinux root directory:         /etc/selinux
   Loaded policy name:             targeted
   Current mode:                   enforcing
   Mode from config file:          enforcing
   Policy MLS status:              enabled
   Policy deny_unknown status:     allowed
   Max kernel policy version:      31

3. Temporarily or permanently disable SELinux.

   Note

   Temporarily disabling SELinux affects only the current session; the original status restores after restart. To permanently disable SELinux, modify the configuration file.

   Temporarily disable SELinux

   Temporarily set SELinux from enforcing to permissive:

   sudo setenforce 0

   Permanently disable SELinux

   1. Open the SELinux config file:

      sudo vi /etc/selinux/config

   2. Find SELINUX=enforcing or SELINUX=permissive, press I to enter Insert mode, and change it to SELINUX=disabled. The configuration file content is as shown below.

      # This file controls the state of SELinux on the system.
      # SELINUX= can take one of these three values:
      #     enforcing - SELinux security policy is enforced.
      #     permissive - SELinux prints warnings instead of enforcing.
      #     disabled - No SELinux policy is loaded.
      SELINUX=enforcing
      # SELINUXTYPE= can take one of three values:
      #     targeted - Targeted processes are protected,
      #     minimum - Modification of targeted policy. Only selected processes are protected.
      #     mls - Multi Level Security protection.
      SELINUXTYPE=targeted

   3. Press Esc, enter :wq, and press Enter to save and close the file.

   4. Restart the ECS instance.

      See Restart an instance.

   5. Check the SELinux status:

      sestatus

      If disabled is returned for SELinux status, SELinux is permanently disabled.