Display current state of SELinux

# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
…

Temporarily Disable/Enable SELinux

To disable SELinux temporarily (without rebooting the linux system) enter the following command with root user:

# setenforce 0

This will turn off the SELinux until you reboot the linux system.

To enable again

# setenforce 1

Permanently Disable/Enable SELinux

To Disable SELinux permanently in linux system modify the /etc/selinux/config file and change “SELinux=enforcing” to “SELinux=disable” as shown below.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted – Only targeted network daemons are protected.
# strict – Full SELinux protection.
SELINUXTYPE=targeted

Configure Booleans instead of disabling entire SELinux

Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing.

Listing Booleans

For a list of Booleans and whether they are on or off, run as root user.

#getsebool -a

In the following example, the httpd_can_sendmail is off:

# getsebool -a | grep sendmail
httpd_can_sendmail –> off

This prevents Apache from sending E-Mail.

Configuring Booleans

Run the setsebool utility in the setsebool boolean_name on/off form to enable or disable Booleans.

The following example demonstrates configuring the httpd_can_network_connect_db Boolean:
By default, the httpd_can_network_connect_db Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers:

Verify the Boolean is disabled:

#getsebool httpd_can_network_connect_db
httpd_can_network_connect_db –> off

To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, run as the Linux root user:

#setsebool httpd_can_network_connect_db

Verify the Boolean is enabled:

#getsebool httpd_can_network_connect_db
httpd_can_network_connect_db –> on

This change is not persistent across reboots. To make changes persistent across reboots, run the setsebool -P boolean-name on command as the Linux root user:

#setsebool -P httpd_can_network_connect_db on