Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers.

Despite /etc/selinux/config being set with disabled or permissive, when the servers boot, selinux is in enforcing mode again.

The only way to disable SELinux is by doing echo 0 > /proc/sys/net/ipv4/tcp_syncookies every time the servers boot.

I know that one solution could be to do a cron job with the abovementioned command on every boot but I wonder if anyone has some idea of what could be the reason why the modification of /etc/selinux/config is not enough (maybe it is enabled somewhere else; any idea on where to look or how to find it?).

share|improve this question

migrated from stackoverflow.com Jan 29 '12 at 21:18

This question came from our site for professional and enthusiast programmers.

In /etc/sysconfig/selinux you want to have SELINUX=disabled and reboot.

Source: http://www.centos.org/docs/5/html/5.2/Deployment_Guide/sec-sel-enable-disable.html

share|improve this answer
You are right, there is also /etc/sysconfig/selinux but both /etc/selinux/config and /etc/sysconfig/selinux are set as SELINUX=disabled and despite of that cat /proc/sys/net/ipv4/tcp_syncookies still says 1 after reboot. – Zillo Jan 28 '12 at 20:11
Just found the solution. No need to disable selinux, just to edit /etc/sysctl.conf where it says net.ipv4.tcp_syncookies = 1 to net.ipv4.tcp_syncookies = 0 – Zillo Jan 28 '12 at 20:29
@Zilo could you post that as an answer please for posterity? – Kyle Jones Jan 31 '12 at 6:10

While I would rather keep SELinux on and make a policy to allow whatever is breaking your server you can always try this to disable SELinux.

$: sudo echo 0 > /selinux/enforce
share|improve this answer
This command failed for me - I needed to run it completely in a subshell so 'root' was actually "writing the file", viz: > > $ sudo echo 0 > /selinux/enforce > -bash: /selinux/enforce: Permission denied > $ sudo bash -c 'echo 0 > /selinux/enforce' > $ – rich p Oct 20 '15 at 2:12
This worked better: $ sudo bash -c 'echo 0 > /selinux/enforce' – rich p Oct 20 '15 at 2:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.