2

I'm trying to disable SELinux on a virtual environment (because a software component we use recommends it, not because I want to)

I have tried setting its status to "disabled" in /etc/selinux/config and rebooting, but unlike other questions where after reboot the config file reverts to "enforcing", in my case the file is successfully modified, yet SELinux remains in enforcing state. Is there an additional setting I could be overlooking, that causes SELinux to not reflect the config file status?

Update: Using setenforce 0 on a virtual instance and rebooting correctly disabled SELinux. However, during our build process (where SELinux should be disabled) the addition of setenforce 0 only switched SELinux to 'permissive'. Stranger still, just editing the config file used to work, until new code was added to disable SWAP before rebooting.

2
  • Did you run setenforce 0 as well?
    – Jeff Schaller
    Commented Dec 16, 2019 at 23:37
  • @JeffSchaller no, I did not.
    – marmant
    Commented Dec 16, 2019 at 23:50

1 Answer 1

0

Did you recreate your initramfs/initrd file and/or your GRUB configuration file after editing the config file? You might have had some other step in your build process that was doing this for you before as a side effect.

If there's an old copy of /etc/selinux/config in initramfs that says "enforcing", then that's what the kernel will do as soon as it starts up; when the root filesystem gets mounted and the system sees the current up-to-date /etc/selinux/config file, it will be too late.

For example in RHEL 8, the /etc/selinux/config status is checked in /lib/dracut/modules.d/98selinux/selinux-loadpolicy.sh which gets included in initramfs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .