Overview

SElinux or Security Enchanced linux is PAIN in the “buttom”. it is designed as military grade security for the US army. That being said if you have it enabled (default) you cannot configure pretty much anything on the software you install without changing the context of the SElinux.

So let's see how to disable and check for status:

Manage

SElinux has three modes: Enforcing Permissive Disabled

The first two are enabling the SElunix, while the last one totally disables it.

You can check if SElinux is currently enabled by issuing the following command:

Check SElinux

That means, that it is enabled and it is the highest priority. If you don't have requirement to have SElinux, I suggest to ALWAYS change the police to “Permissive” that means it will still monitor the access and yells at you when you violate it, but it won't stop your work.

Let's see how we can disable it:

Enable / Disable

To change the mode to Permissive and reverse, we can use the following command:

Change modes

We cannot totally disable it while the Linux is working, we have to restart. Also bare in mind that any change (with setenforce) doesn't survive a restart. To disable it totally and/or to make our changes persistant, we have to modify the following file:

Persistant Change

Modift SELinux Context

SElinux operates in contexts. But before we start checking the context of files and directories, we have to install the proper tools:

Install tools to manage SElinux

That will give us the “semanage” command. Now there are 2 ways to manage the contaxt of a file or directory:

Use chcon - temporary

Use semanage & restorecon - permanent

So let's try it. Firstly we check the context as follows:

Check Context

In this example, the SELinux context for file1 includes the SELinux unconfined_u user, object_r role, user_home_t type, and the s0 level. For a description of each part of the SELinux context here

Change the context temporary

To change it temporary we can use the following command:

Check Context

Change the context temporary

Again, that is not a permanent change so we can restore it with restart OR using restorecon:

Restore the context

Change the context permanent

To change the context permanently we have to use the “semanage” as follows:

Change the context