I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot.

It's too easy for a root user to run setenforce permissive, make changes - such as running unconfined programs, or changing contexts - and then re-enable enforcing mode. Sure, it'll be logged, but that may go unnoticed.


secure_mode_policyload boolean should provide such functionality:

Boolean to determine whether the system permits loading policy, setting enforcing mode, and changing boolean values. Set this to true and you have to reboot to set it back.

When enabled, modifications to SELinux policy are not possible (including changing permissive/enforcing mode) and turning the boolean off requires a reboot.

To turn it on until next boot:

setsebool secure_mode_policyload on

  • Magic, thanks exactly what I want. I had searched, but got nowhere. It can be set on the fly (to test) with setsebool secure_mode_policyload on, after which setenforce permissive fails. – Graham Nicholls Oct 2 '18 at 11:13
  • I'm not actually certain how the boolean works (or is there possible issues) if it is made persistent, so I altered my answer to use setsebool. – sebasth Oct 2 '18 at 11:29
  • Yes, I guess it could be possible to get into a situation where it was very difficult to change. I'm expecting the users to switch off SELinux as soon as they first hit a problem, TBH, which is a shame. – Graham Nicholls Oct 2 '18 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.