1

I have a minimal CentOS 7.5.1804 (Core) system and trying to change SELinux mode from Disabled to Enforcing but when I tried to change mode using setenforce 1 command, I got an error message says:
setenforce: SELINUX is disabled

I changed /etc/selinux/config file as follows:

# This file controls the state of SELinux on the system.`
# SELINUX= can take one of these three values:`
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are pr$
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

I rebooted system a couple of times but still SELinux is disabled.

Where am I suppose to check now? Is there any other mechanism above /etc/selinux/config file that can manipulate SELinux status?

Note 1 : I didn't install and configure CentOS 7 on the machine at first hand. So, certain customization might have been done after the installation. System currently has three SELinux policy packages as follows:

selinux-policy-minimum
selinux-policy-mls
selinux-policy-targeted

Note 2 : This question is similar with SELINUX won't enable and i know it has closed with an off-topic flag. But it closed because the user is on linode with a linode provided (custom) kernel that doesn't support SELinux (as Stephen Harris says in comments)

  • 5
    cat /proc/cmdline there is probably selinux=0 enforcing=0. if so - change your grub configuration. – Alexander Aug 29 '18 at 8:16
  • some RHEL documentation. Note the required packages in chapter 4.3. look for Alexander's provided offending toggles in /etc/default/grub (+ man grub2-mkconfig) – A.B Aug 29 '18 at 21:09
2

I did some researches considering comments of Alexander and A.B. Solution steps that I implemented as follows:

  1. In /etc/grub.d/ directory, a file called 40_custom contains an expression as selinux=0 (btw I was seeing the same expression at grub bootloader menu). I changed it to selinux=1.
  2. Executing commandgrub2-mkconfig -0 /boot/grub2/grub.cfg. Executing ends successfully.
  3. I checked once again if /etc/selinux/config file has the SELINUX=enforcing expression.

After a reboot, SELinux getenforce command shows Enforcing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.