I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run setenforce 0 everything is fine, but I have to run that command every time the server restarts. I tried changing /etc/sysconfig/selinux to SELINUX=disabled and also SELINUX=permissive before restarting, but sestatus keeps showing that centOS starts with selinux running. Do I need to change a different config file, or have I configured the selinux file incorrectly?

Youtube video showing selinux config file, rebooting and then checking status

  • It seems like this guy has the same issue in fedora: serverfault.com/questions/500957/… – Programster Apr 21 '13 at 11:15
  • 1
    Disabling SELinux is never the right answer. You should put it into Permissive mode, then use "sealert -a /var/log/audit/audit.log" to see what would be blocked in "Enforcing" mode. Remedy those issues with either "restorecon" (mislabeled files), setting SELinux booleans, or using audit2allow to create a custom policy for your system. – tgharold Jun 2 '13 at 22:54

you need to set it in /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.

The correct location to pass selinux=0 as kernel boot paramater is in /etc/grub.conf

kernel /boot/vmlinuz-2.6.32-358.2.1.el6.x86_64 ro root=/dev/xvda1 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto console=tty0 selinux=0

PS SELinux should be only set to permissive to debug a problem, run it in permissive see what gets logged to /var/log/audit.log fix the denials then switch it back to enforcing do not run it in permissive or disabled long term.

  • When I originally read this answer I had not properly read the paths. I needed to change /etc/selinux/config instead of /etc/sysconfig/selinux as you stated. – Programster May 1 '13 at 15:47

Setting SELINUX=disabled in the file /etc/sysconfig/selinux should be enough. You can also disable it from the kernel. Edit the file /etc/default/grub and add selinux=0 to the GRUB_CMDLINE_LINUX variable and update your GRUB configuration:

shell# grub2-mkconfig -o /etc/grub2.cfg

After rebooting, check SELinux status. The getenforce command should print Disabled.

  • Ok well I have rebooted and used 'getenforce' instead of sestatus. It outputs Enforcing. Here is a video to show: youtu.be/hZzP-kOtGfU – Programster Apr 21 '13 at 11:20
  • I've edited my answer. – Spack Apr 21 '13 at 11:32
  • It appears that I do not have a /etc/default/grub file. Perhaps I need to edit the /etc/grub.conf file? There is no GRUB_CMDLINE_LINUX variable in there though. Also grub2-mkconfig -o /etc/grub2.cfg resulted in grub2-mkconfig: command not found Perhaps I should let you know that I am running a bare minimal centos 6.4 net-install... – Programster Apr 21 '13 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.