How to control SELinux in CentOS 7

SELinux – when installed – can take on one of three modes:

  • Enforcing
  • Permissive
  • Disabled

To check which mode SELinux is running on, we can use either sestatus for a more detailed output, or simply getenforce for a one liner:

getenforce on the other hand will literally just say a single word, like “Enforcing”.

To change this mode, edit /etc/selinux/config:

Change the file according to the comments and restart the system for the changes to take effect.

setenforce command

If SELinux is running and either set to Enforcing or Permissive, you can change its mode on the fly without restarting the server using the setenforce command like so:

You won’t get any feedback if all goes well. Note that if SELinux is disabled, the setenforce command won’t work.

setenforce is practical if you’d like to change the SELinux policy only temporary and your settings will not be retained. So the next time you restart the server, SELinux will come back with whatever is set in /etc/selinux/config.

Find out more about SELinux and what it’s good for here:

About Jay Versluis

Jay is a medical miracle known as a Super Survivor. He runs two YouTube channels, five websites and several podcast feeds. To see what else he's up to, and to support him on his mission to make the world a better place, check out his Patreon Campaign.

One thought on “How to control SELinux in CentOS 7

Add your voice!