4 methods to disable SELinux
In some Linux distributions, SELinux is enabled by default, which can lead to various issues. If you do not understand how SELinux works and are unable to configure it properly, it is best to disable it until you have learned its basic principles.
To disable SELinux, you can use any of the 4 methods described below.
We will not dwell in detail on the purpose of SELinux and will proceed directly to disabling it. If SELinux is enabled in the system, running the command ls -Z will display output similar to the following.
# ls -Z /etc/
-rw-r--r-- root root system_u:object_r:etc_t:s0 a2ps.cfg
-rw-r--r-- root root system_u:object_r:adjtime_t:s0 adjtime
-rw-r--r-- root root system_u:object_r:etc_aliases_t:s0 aliases
drwxr-x--- root root system_u:object_r:auditd_etc_t:s0 audit
drwxr-xr-x root root system_u:object_r:etc_runtime_t:s0 blkid
drwxr-xr-x root root system_u:object_r:bluetooth_conf_t:s0 bluetooth
drwx------ root root system_u:object_r:system_cron_spool_t:s0 cron.d
-rw-rw-r-- root disk system_u:object_r:amanda_dumpdates_t:s0 dumpdates
Method 1: Temporarily disable SELinux
To temporarily disable SELinux, you can modify the file /selinux/enforce. Note that this is a temporary disable, and SELinux will be re-enabled after a system reboot.
# cat /selinux/enforce
1
# echo 0 > /selinux/enforce
# cat /selinux/enforce
0
You can also use the setenforce command, as shown in the example below. The possible parameters for the setenforce command are: Enforcing, Permissive, 1 (enable), or 0 (disable).
# setenforce 0
Method 2: Permanently disable SELinux
To permanently disable SELinux, edit the file /etc/selinux/config and set SELINUX=disabled as shown below. Then, reboot the server.
# cat /etc/selinux/config
SELINUX=disabled
SELINUXTYPE=targeted
SETLOCALDEFS=0
Method 3: Disable SELinux in the GRUB bootloader
The third method uses the capabilities of the GRUB system bootloader to disable SELinux. Add selinux=0 to the end of the kernel line.
# cat /boot/grub/grub.conf
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5PAE)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5PAE ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5PAE.img
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5 ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5.img
Method 4: Disable SELinux only for specific services – HTTP/Apache
If you need to disable SELinux not entirely, but only for specific services, you have this option. For example, to disable SELinux for HTTP/Apache, change the value of the httpd_disable_trans variable in the file /etc/selinux/targeted/booleans.
# grep httpd /etc/selinux/targeted/booleans
httpd_builtin_scripting=1
<strong>httpd_disable_trans=1
</strong>httpd_enable_cgi=1
httpd_enable_homedirs=1
httpd_ssi_exec=1
httpd_tty_comm=0
httpd_unified=1
Set the variable using the setsebool command. Then restart httpd for the changes to take effect.
# <strong>setsebool httpd_disable_trans 1
</strong># service httpd restart