3

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot.

It's too easy for a root user to run setenforce permissive, make changes - such as running unconfined programs, or changing contexts - and then re-enable enforcing mode. Sure, it'll be logged, but that may go unnoticed.

1 Answer 1

Reset to default
3

secure_mode_policyload boolean should provide such functionality:

Boolean to determine whether the system permits loading policy, setting enforcing mode, and changing boolean values. Set this to true and you have to reboot to set it back.

When enabled, modifications to SELinux policy are not possible (including changing permissive/enforcing mode) and turning the boolean off requires a reboot.

To turn it on until next boot:

setsebool secure_mode_policyload on

3
  • Magic, thanks exactly what I want. I had searched, but got nowhere. It can be set on the fly (to test) with setsebool secure_mode_policyload on, after which setenforce permissive fails.
    – Graham Nicholls
    Oct 2, 2018 at 11:13
  • I'm not actually certain how the boolean works (or is there possible issues) if it is made persistent, so I altered my answer to use setsebool.
    – sebasth
    Oct 2, 2018 at 11:29
  • Yes, I guess it could be possible to get into a situation where it was very difficult to change. I'm expecting the users to switch off SELinux as soon as they first hit a problem, TBH, which is a shame.
    – Graham Nicholls
    Oct 2, 2018 at 11:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .