21.2.2. SELinux Configuration Files
The following sections describe SELinux configuration and policy files, and related file systems located in the
/etc/ directory.
21.2.2.1. The /etc/sysconfig/selinux Configuration File
There are two ways to configure SELinux under Red Hat Enterprise Linux: using the Security Level Configuration Tool (
system-config-securitylevel), or manually editing the configuration file (/etc/sysconfig/selinux).
The
/etc/sysconfig/selinux file is the primary configuration file for enabling or disabling SELinux, as well as setting which policy to enforce on the system and how to enforce it.
Note
The
/etc/sysconfig/selinux contains a symbolic link to the actual configuration file, /etc/selinux/config.
The following explains the full subset of options available for configuration:
SELINUX=<enforcing|permissive|disabled>— Defines the top-level state of SELinux on a system.enforcing— The SELinux security policy is enforced.permissive— The SELinux system prints warnings but does not enforce policy. This is useful for debugging and troubleshooting purposes. In permissive mode, more denials will be logged, as subjects will be able to continue with actions otherwise denied in enforcing mode. For example, traversing a directory tree will produce multipleavc: deniedmessages for every directory level read, where a kernel in enforcing mode would have stopped the initial traversal and kept further denial messages from occurring.disabled— SELinux is fully disabled. SELinux hooks are disengaged from the kernel and the pseudo-file system is unregistered.Note
Actions made while SELinux is disabled may cause the file system to no longer have the proper security context as defined by the policy. Runningfixfiles relabelprior to enabling SELinux will relabel the file system so that SELinux works properly when enabled. For more information, refer to thefixfiles(8) manpage.
Note
Additional white space at the end of a configuration line or as extra lines at the end of the file may cause unexpected behavior. To be safe, remove unnecessary white spaces.SELINUXTYPE=<targeted|strict>— Specifies which policy is currently being enforced by SELinux.targeted— Only targeted network daemons are protected.Important
The following daemons are protected in the default targeted policy:dhcpd,httpd (apache.te),named,nscd,ntpd,portmap,snmpd,squid, andsyslogd. The rest of the system runs in theunconfined_tdomain.The policy files for these daemons can be found in/etc/selinux/targeted/src/policy/domains/programand are subject to change, as newer versions of Red Hat Enterprise Linux are released.Policy enforcement for these daemons can be turned on or off, using Boolean values controlled by Security Level Configuration Tool (system-config-securitylevel). Switching a Boolean value for a targeted daemon disables the policy transition for the daemon, which prevents, for example,initfrom transitioningdhcpdfrom theunconfined_tdomain to the domain specified indhcpd.te. The domainunconfined_tallows subjects and objects with that security context to run under standard Linux security.strict— Full SELinux protection, for all daemons. Security contexts are defined for all subjects and objects, and every single action is processed by the policy enforcement server.
