Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers.

Despite /etc/selinux/config being set with disabled or permissive, when the servers boot, selinux is in enforcing mode again.

The only way to disable SELinux is by doing echo 0 > /proc/sys/net/ipv4/tcp_syncookies every time the servers boot.

I know that one solution could be to do a cron job with the abovementioned command on every boot but I wonder if anyone has some idea of what could be the reason why the modification of /etc/selinux/config is not enough (maybe it is enabled somewhere else; any idea on where to look or how to find it?).

share|improve this question

migrated from Jan 29 '12 at 21:18

This question came from our site for professional and enthusiast programmers.

2 Answers 2

In /etc/sysconfig/selinux you want to have SELINUX=disabled and reboot.


share|improve this answer
You are right, there is also /etc/sysconfig/selinux but both /etc/selinux/config and /etc/sysconfig/selinux are set as SELINUX=disabled and despite of that cat /proc/sys/net/ipv4/tcp_syncookies still says 1 after reboot. – Zillo Jan 28 '12 at 20:11
Just found the solution. No need to disable selinux, just to edit /etc/sysctl.conf where it says net.ipv4.tcp_syncookies = 1 to net.ipv4.tcp_syncookies = 0 – Zillo Jan 28 '12 at 20:29
@Zilo could you post that as an answer please for posterity? – Kyle Jones Jan 31 '12 at 6:10

While I would rather keep SELinux on and make a policy to allow whatever is breaking your server you can always try this to disable SELinux.

$: sudo echo 0 > /selinux/enforce
share|improve this answer
This command failed for me - I needed to run it completely in a subshell so 'root' was actually "writing the file", viz: > > $ sudo echo 0 > /selinux/enforce > -bash: /selinux/enforce: Permission denied > $ sudo bash -c 'echo 0 > /selinux/enforce' > $ – rich p Oct 20 at 2:12
This worked better: $ sudo bash -c 'echo 0 > /selinux/enforce' – rich p Oct 20 at 2:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.