We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers.
/etc/selinux/config being set with disabled or permissive, when the servers boot, selinux is in enforcing mode again.
The only way to disable SELinux is by doing
echo 0 > /proc/sys/net/ipv4/tcp_syncookies every time the servers boot.
I know that one solution could be to do a cron job with the abovementioned command on every boot but I wonder if anyone has some idea of what could be the reason why the modification of
/etc/selinux/config is not enough (maybe it is enabled somewhere else; any idea on where to look or how to find it?).