RHEL SELinux: /etc/sysconfig/selinux or /etc/selinux/config?

Question

I am running CentOS Linux release 7.5.1804 (Core), and bumped into the usual set SELinux to Permissive task. But then my two sources gave me two different locations where the config should be set:

1. /etc/sysconfig/selinux

cat /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.

2. /etc/selinux/config

cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     permissive - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of permissive.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

I have read the relevant RedHat forums but nobody seems particularly hung up on either / or. Also read Selinux - centos - missing /etc/selinux/config, both solutions are there for an answer.

Which one should I use for my current version?

Which one should I use going forward for newer versions?

UPDATE: They are not symlinked in my system. In fat they are two rather different files:

ls -la /etc/selinux/ | grep config
-rw-r--r--.  1 root root  550 Jan 14 15:55 config
ls -la /etc/sysconfig/ | grep selinux
-rw-r--r--.  1 root root  543 Jan 10 14:12 selinux

Answer 1

From a CentOS 7 system I have to hand, but CentOS 6 and Fedora 31 are the same

lrwxrwxrwx. 1 root root   17 Oct 31  2018 selinux -> ../selinux/config

Seems they are the same file. Personally use /etc/selinx/config due to muscle memory.

---

but in my system they are different files, size is diff, change time is diff

Then consider that your system is 'broken'. This is easy to test, set permissive in one and enforcing in the other. Reboot ...

Answer 2

The default selinux configuration file is in /etc/selinux/config per man 8 selinux. In Appendix D of the RHEL 6 Deployment Guide (couldn't find in RHEL 7 doc), they mention that /etc/sysconfig is a symbolic link to /etc/selinux/config:

The /etc/sysconfig/selinux file contains the basic configuration options for SELinux. It is a symbolic link to /etc/selinux/config

You'll know it's a symlink when you see the ls -la output because the first field will be l, for link, and the ugo will have rwx:

[root@test sysconfig]# ls -lah selinux
lrwxrwxrwx. 1 root root 19 Nov 24 00:58 selinux -> /etc/selinux/config

Before I learned that this was a symlink, I accidentally overwrote the file with sed because by default sed doesn't follow symlinks:

[root@test sysconfig]# ls -lah selinux
lrwxrwxrwx. 1 root root 17 Jul 24 23:16 selinux -> ../selinux/config
[root@test sysconfig]# grep '^SELINUX=' selinux
SELINUX=enforcing
[root@test sysconfig]# sed -i 's/SELINUX=enforcing/SELINUX=permissive/' selinux
[root@test sysconfig]# ls -lah selinux
-rw-r--r--. 1 root root 544 Nov 24 00:50 selinux

If you ever get in that situation, it's an easy fix to restore the symlink:

[root@test sysconfig]# rm /etc/sysconfig/selinux
rm: remove regular file ‘/etc/sysconfig/selinux’? y
[root@test sysconfig]# ln -s /etc/selinux/config selinux
[root@test sysconfig]# ls -lah selinux
lrwxrwxrwx. 1 root root 19 Nov 24 00:52 selinux -> /etc/selinux/config

I am personally only modifying /etc/selinux/config, one so I don't happen to make another mistake with the symlink, but two because some configuration files in that directory are becoming deprecated in newer releases; for example, nfs in RHEL 8.