8.3.4. Permissive Domains
When SELinux is running in permissive mode, SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode. Previously, it was not possible to make a single domain permissive (remember: processes run in domains). In certain situations, this led to making the whole system permissive to troubleshoot issues.
Permissive domains allow an administrator to configure a single process (domain) to run permissive, rather than making the whole system permissive. SELinux checks are still performed for permissive domains; however, the kernel allows access and reports an AVC denial for situations where SELinux would have denied access.
Permissive domains have the following uses:
- They can be used for making a single process (domain) run permissive to troubleshoot an issue without putting the entire system at risk by making it permissive.
- They allow an administrator to create policies for new applications. Previously, it was recommended that a minimal policy be created, and then the entire machine put into permissive mode, so that the application could run, but SELinux denials still logged.
audit2allowcould then be used to help write the policy. This put the whole system at risk. With permissive domains, only the domain in the new policy can be marked permissive, without putting the whole system at risk.
8.3.4.1. Making a Domain Permissive
To make a domain permissive, run the
semanage permissive -a domain command, where domain is the domain you want to make permissive. For example, run the following command as the Linux root user to make the httpd_t domain (the domain the Apache HTTP Server runs in) permissive:
~]# semanage permissive -a httpd_t
To view a list of domains you have made permissive, run the
semodule -l | grep permissive command as the Linux root user. For example:
~]# semodule -l | grep permissive
permissive_httpd_t 1.0
permissivedomains 1.0.0
If you no longer want a domain to be permissive, run the
semanage permissive -d domain command as the Linux root user. For example:
~]# semanage permissive -d httpd_t