How to Disable or Turn Off SELinux on CentOS 7?

Introduction

In the world of Linux, security is a top concern for system administrators. One way to enhance security on a Linux system is by using Security-Enhanced Linux (SELinux).

SELinux is a mandatory access control (MAC) system that provides an additional layer of protection for your CentOS 7 server. It provides granular access controls and policies that enable system administrators to restrict users' actions and protect sensitive data.

Checking the Current Status of SELinux

SELinux (Security-Enhanced Linux) is a security mechanism that offers an additional layer of protection to your system by limiting the access of processes and users to certain resources. CentOS 7 comes with SELinux enabled by default. In some cases, you may need to check whether it is running or not before proceeding with any configuration changes.

Using the getenforce command

The easiest way to check the current status of SELinux is by using the getenforce command. This command shows if SELinux is currently enforcing, permissive, or disabled on your CentOS 7 system. To use this command, open a terminal window and type−

getenforce

If SELinux is currently enforcing on your system, this command will return “Enforcing”. If it’s running in permissive mode (also known as "logged" mode), it will return “Permissive”.

If SELinux is completely disabled, "Disabled" will be returned. It's important to note that on newer versions of CentOS 7 (e.g., CentOS 7.6), the output for getenforce may display “disabled” when it's actually not completely disabled due to other features like System Security Services Daemon (SSSD) and auditd that may still be running in enforcing mode even when you've set SELINUX=disabled in /etc/sysconfig/selinux file.

Using the getenforce command can help you identify whether or not SELinux is currently active on your CentOS 7 system and its current state. This can be helpful when troubleshooting security issues or determining whether or not further configuration changes are needed.

Disabling SELinux Temporarily

Sometimes, you may need to disable SELinux temporarily to troubleshoot a particular issue in CentOS 7. This can be done using the setenforce command, which is used to change the current SELinux mode. The setenforce command has two modes: enforcing and permissive.

The enforcing mode is the default mode for SELinux, and it enforces all security policies defined by SELinux. On the other hand, permissive mode only logs policy violations without enforcing them. In permissive mode, SELinux will not block any actions but will log them instead.

To disable SELinux temporarily in CentOS 7 using the setenforce command, follow these steps −

Log in to your CentOS 7 system with root privileges.

Open a terminal window.

Type the following command to check the current status of SELinux −

$ getenforce

The output will show either "Enforcing" or "Permissive". If it shows "Enforcing", you need to run the following command−

$ setenforce 0

This sets the SELinux state to permissive mode, which means that it will not block any actions but will log them instead. You can confirm that it has been changed by typing −

$ getenforce

The output should now show "Permissive".

Note that this change is temporary and will not survive a reboot. If you want to permanently disable or turn off SELinux on your CentOS 7 system, proceed to the next section.

Turning Off SELinux Permanently

Sometimes, you might want to turn off SELinux permanently. This can be done by editing the /etc/selinux/config file. This file is used to set the default SELinux mode during system startup.

Editing the /etc/selinux/config file

To edit the /etc/selinux/config file, you must have root access to the server. Open the terminal on your CentOS 7 machine and enter −

$ sudo nano /etc/selinux/config

This will open the configuration file in Nano editor. Look for the line that starts with "SELINUX=". The value of this line indicates whether SELinux is enabled or disabled−

# This file controls the state of SELinux on the system. 
# SELINUX= can take one of these three values: 

# enforcing - SELinux security policy is enforced. 
# permissive - SELinux prints warnings instead of enforcing. 
# disabled - No SELinux policy is loaded. SELINUX=enforcing 

To turn off SELinux permanently, change "enforcing" to "disabled" −

# This file controls the state of SELinux on the system. 
# SELINUX= can take one of these three values: 

# enforcing - SELinux security policy is enforced. 
# permissive - SELinux prints warnings instead of enforcing. 
# disabled - No SELinux policy is loaded. SELINUX=disabled 

Once you have made this change, save and close /etc/selinux/config by pressing Ctrl+X followed by Y and then Enter. Note that changes to /etc/selinux/config require a system reboot for them to take effect. After rebooting your CentOS 7 server, run the getenforce command to ensure that SELinux is now disabled −

$ getenforce

The output should be "Disabled". Your CentOS 7 server is now running without SELinux.

Verifying that SELinux is Disabled or Turned Off

Once you have disabled or turned off SELinux on CentOS 7, it is important to verify that the changes have been applied correctly. This section will guide you through some methods of verifying this.

Method 1: Using the getenforce Command

The easiest way to check whether SELinux is currently disabled or turned off temporarily is by using the getenforce command. This command displays the current status of SELinux on your system.

To check the current status of SELinux, open your terminal and type −

$ getenforce 

If this command returns "Disabled" or "Permissive," then you have successfully disabled or turned off SELinux temporarily. However, if it returns "Enforcing," then SELinux is still enabled and enforcing policies.

Method 2: Checking File /etc/selinux/config

You can also verify whether SELinux has been permanently disabled, by checking the configuration file located at /etc/selinux/config. If you have followed all the steps correctly for disabling SELinux permanently, this file should contain a line similar to −

SELINUX=disabled 

If it says "SELINUX=enforcing" instead, then you need to make sure that you edited and saved this file correctly before rebooting your system.

Method 3: Using Sestatus Command

You can also use Sestatus , a powerful tool for managing and querying SELinux status.

$ sudo sestatus 

This command displays the current status of SELinux and provides additional information, such as enabled policies and booleans. If SELinux is disabled or turned off permanently, this command should show the following −

SELinux status: disabled  

If it returns "SELinux status: enabled" instead, then you need to make sure that you followed all the steps correctly for disabling SELinux permanently before rebooting your system.

Conclusion

While disabling or turning off SELinux may temporarily solve some issues on CentOS 7 machines, it is important to keep in mind that it is a vital security feature. SELinux adds an additional layer of protection to your system by limiting access and permissions granted to processes.