SELinux

Controlling SELinux

Controlling SELinux entails three primary operations:

• Switching the SELinux mode

• Loading a security policy

• Labeling files

The following subsections explain how to perform these operations.

Tip

The available commands and the associated command options provided by a given implementation of SELinux may differ a bit from those described in the following subsections. When you encounter such differences, you should check your system man pages and other available documentation to understand the operation of your system.

Switching Modes

If your Linux kernel was compiled with the NSA SELinux Development support option, you can specify the SELinux operating mode that should be entered when your SELinux system is booted. And, unless the SELinux security policy specifies otherwise, you can dynamically change the operating mode of a running SELinux system. Additionally, if your Linux kernel was compiled with the NSA SELinux boot parameter option, you can entirely disable SELinux via a boot parameter. The following subsections explain how to do so.

Setting the initial operating mode

The initial operating mode of an SELinux system can be set via the boot parameter enforcing. To boot the system into enforcing mode, assign this boot parameter the value 1; to boot the system into permissive mode, assign this boot parameter the value 0.

If you use GRUB to boot your system and want the system to automatically boot into enforcing mode, you might specify a kernel directive such as the following ...