I have some systems where, for various reasons, we want to completely disable selinux. To date, this has worked like a champ, with always using selinux=0 in the kickstarts and ensuring that /etc/sysconfig/selinux contains:
But as of today, I have one Fedora 17 workstation that is properly set up, yet following many reboots, it always comes up in enforcing mode:
# cat /etc/sysconfig/selinux # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted # getenforce Enforcing
What could be causing selinux to ignore the sysconfig entry, or to start despite it?
I saw a related question here and tried this:
# selinuxenabled ; echo $? 0 # getenforce Enforcing