1

I have a minimal CentOS 7.5.1804 (Core) system and trying to change SELinux mode from Disabled to Enforcing but when I tried to change mode using setenforce 1 command, I got an error message says:
setenforce: SELINUX is disabled

I changed /etc/selinux/config file as follows:

# This file controls the state of SELinux on the system.`
# SELINUX= can take one of these three values:`
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are pr$
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

I rebooted system a couple of times but still SELinux is disabled.

Where am I suppose to check now? Is there any other mechanism above /etc/selinux/config file that can manipulate SELinux status?

Note 1 : I didn't install and configure CentOS 7 on the machine at first hand. So, certain customization might have been done after the installation. System currently has three SELinux policy packages as follows:

selinux-policy-minimum
selinux-policy-mls
selinux-policy-targeted

Note 2 : This question is similar with SELINUX won't enable and i know it has closed with an off-topic flag. But it closed because the user is on linode with a linode provided (custom) kernel that doesn't support SELinux (as Stephen Harris says in comments)

2
  • 5
    cat /proc/cmdline there is probably selinux=0 enforcing=0. if so - change your grub configuration.
    – Alexander
    Aug 29, 2018 at 8:16
  • some RHEL documentation. Note the required packages in chapter 4.3. look for Alexander's provided offending toggles in /etc/default/grub (+ man grub2-mkconfig)
    – A.B
    Aug 29, 2018 at 21:09

1 Answer 1

2

I did some researches considering comments of Alexander and A.B. Solution steps that I implemented as follows:

  1. In /etc/grub.d/ directory, a file called 40_custom contains an expression as selinux=0 (btw I was seeing the same expression at grub bootloader menu). I changed it to selinux=1.
  2. Executing commandgrub2-mkconfig -0 /boot/grub2/grub.cfg. Executing ends successfully.
  3. I checked once again if /etc/selinux/config file has the SELINUX=enforcing expression.

After a reboot, SELinux getenforce command shows Enforcing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .