DEV Community

Janak Shrestha
Janak Shrestha

Posted on

SElinux Installation and Configuration

#linux

Following a security audit, the xFusionCorp Industries security team has opted to enhance application and server security with SELinux. To initiate testing, the following requirements have been established for App server 2 in the Stratos Datacenter:

Install the required SELinux packages.

Permanently disable SELinux for the time being; it will be re-enabled after necessary configuration changes.

No need to reboot the server, as a scheduled maintenance reboot is already planned for tonight.

Disregard the current status of SELinux via the command line; the final status after the reboot should be disabled.

Solution

Step 1: Connect to App Server 2 (stapp02) 

ssh steve@stapp02
# Password: Am3ric@
Enter fullscreen mode Exit fullscreen mode

Step 2: Switch to root or use sudo 

sudo su -
# Password: Am3ric@
Enter fullscreen mode Exit fullscreen mode

Step 3: Install SELinux packages (if not already installed) 

# Check if SELinux packages are installed
rpm -qa | grep selinux

# Install SELinux packages
yum install -y selinux-policy selinux-policy-targeted libselinux-utils
Enter fullscreen mode Exit fullscreen mode

Step 4: Check current SELinux status 

# Check current SELinux status
getenforce
sestatus
Enter fullscreen mode Exit fullscreen mode

Step 5: Permanently disable SELinux 

# Edit the SELinux configuration file
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
# or
sed -i 's/SELINUX=permissive/SELINUX=disabled/g' /etc/selinux/config

# If SELINUX line doesn't exist, add it
grep -q "^SELINUX=" /etc/selinux/config || echo "SELINUX=disabled" >> /etc/selinux/config
Enter fullscreen mode Exit fullscreen mode

Step 6: Verify the configuration 

# Check the config file
cat /etc/selinux/config

# Verify SELINUX is set to disabled
grep "^SELINUX=" /etc/selinux/config

# Current status (will still show enforcing/permissive until reboot)
getenforce
sestatus
Enter fullscreen mode Exit fullscreen mode

Step 7: Set SELinux to permissive mode (optional, for testing) 

# This makes the system permissive until reboot
setenforce 0

# Verify it's now permissive
getenforce
Enter fullscreen mode Exit fullscreen mode

Complete One-Line Commands

From jump host with password: 

echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'yum install -y selinux-policy selinux-policy-targeted libselinux-utils && sed -i \"s/SELINUX=enforcing/SELINUX=disabled/g\" /etc/selinux/config && sed -i \"s/SELINUX=permissive/SELINUX=disabled/g\" /etc/selinux/config && grep SELINUX= /etc/selinux/config'"
Enter fullscreen mode Exit fullscreen mode

Using heredoc (Recommended): 

ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "=== Installing SELinux packages ==="
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

echo ""
echo "=== Current SELinux status ==="
getenforce
sestatus

echo ""
echo "=== Configuring SELinux to be disabled ==="
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
sed -i "s/SELINUX=permissive/SELINUX=disabled/g" /etc/selinux/config

# Ensure SELINUX is set to disabled
if ! grep -q "^SELINUX=disabled" /etc/selinux/config; then
    sed -i "s/^SELINUX=.*/SELINUX=disabled/g" /etc/selinux/config
fi

echo ""
echo "=== Verifying configuration ==="
grep "^SELINUX=" /etc/selinux/config

echo ""
echo "=== Setting SELinux to permissive mode (current session) ==="
setenforce 0

echo ""
echo "=== Current SELinux status (will be permissive until reboot) ==="
getenforce

echo ""
echo "✅ SELinux has been permanently disabled"
echo "⚠️  Current status: $(getenforce) (will change to disabled after reboot)"
echo "ℹ️  Configuration file: /etc/selinux/config"
echo "ℹ️  SELINUX=disabled will take effect after reboot"
'
EOF
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands 

# Connect to stapp02
ssh steve@stapp02
# Enter password: Am3ric@

# Become root
sudo su -
# Enter password: Am3ric@

# Step 1: Check if SELinux packages are installed
echo "=== Checking SELinux packages ==="
rpm -qa | grep selinux

# Step 2: Install SELinux packages
echo "=== Installing SELinux packages ==="
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

# Step 3: Check current SELinux status
echo "=== Current SELinux status ==="
getenforce
sestatus

# Step 4: View current SELinux config
echo "=== Current SELinux config ==="
cat /etc/selinux/config

# Step 5: Permanently disable SELinux
echo "=== Disabling SELinux permanently ==="
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
sed -i 's/SELINUX=permissive/SELINUX=disabled/g' /etc/selinux/config

# If the line doesn't exist, add it
if ! grep -q "^SELINUX=" /etc/selinux/config; then
    echo "SELINUX=disabled" >> /etc/selinux/config
fi

# Step 6: Verify the configuration
echo "=== Verified SELinux config ==="
grep "^SELINUX=" /etc/selinux/config

# Step 7: Set SELinux to permissive for current session (optional)
echo "=== Setting SELinux to permissive mode (current session) ==="
setenforce 0

# Step 8: Check current status
echo "=== Current SELinux status ==="
getenforce
sestatus

# Step 9: Show final configuration
echo "=== Final configuration ==="
echo "SELINUX is set to: $(grep ^SELINUX= /etc/selinux/config | cut -d= -f2)"
echo "Current SELinux mode: $(getenforce)"

# Exit back
exit
exit
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp02 ~]# yum install -y selinux-policy selinux-policy-targeted libselinux-utils
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Package selinux-policy-3.14.3-80.el8.noarch already installed and latest version
Package selinux-policy-targeted-3.14.3-80.el8.noarch already installed and latest version
Package libselinux-utils-2.9-5.el8.x86_64 already installed and latest version
Nothing to do

[root@stapp02 ~]# getenforce
Enforcing

[root@stapp02 ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

[root@stapp02 ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

[root@stapp02 ~]# grep ^SELINUX= /etc/selinux/config
SELINUX=disabled

[root@stapp02 ~]# setenforce 0
[root@stapp02 ~]# getenforce
Permissive

[root@stapp02 ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          disabled
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
Enter fullscreen mode Exit fullscreen mode

Alternative Methods

Method 1: Using echo to overwrite (if using a different approach) 

# Update the config file directly
echo "SELINUX=disabled" > /etc/selinux/config
echo "SELINUXTYPE=targeted" >> /etc/selinux/config
Enter fullscreen mode Exit fullscreen mode

Method 2: Using sed with backup 

# Create backup and modify
cp /etc/selinux/config /etc/selinux/config.backup
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
Enter fullscreen mode Exit fullscreen mode

Method 3: Using awk to replace 

awk '/^SELINUX=/ {print "SELINUX=disabled"; next} {print}' /etc/selinux/config > /tmp/selinux_config
mv /tmp/selinux_config /etc/selinux/config
Enter fullscreen mode Exit fullscreen mode

Method 4: Using systemd to disable SELinux (alternative) 

# Add kernel parameter to disable SELinux
grubby --update-kernel ALL --args "selinux=0"
Enter fullscreen mode Exit fullscreen mode

Verification Commands 

# 1. Check SELinux config file
cat /etc/selinux/config | grep -E "^SELINUX=|^SELINUXTYPE="

# 2. Check current SELinux status
getenforce
sestatus

# 3. Check SELinux packages
rpm -qa | grep selinux

# 4. Check kernel boot parameters (for future verification)
grubby --info=ALL | grep selinux

# 5. Check if SELinux is disabled in the config
grep -q "^SELINUX=disabled" /etc/selinux/config && echo "SELINUX is disabled in config" || echo "SELINUX is not disabled in config"

# 6. Check current mode and config mode
echo "Current mode: $(getenforce)"
echo "Config mode: $(grep ^SELINUX= /etc/selinux/config | cut -d= -f2)"

# 7. Verify no reboot is needed for config change
echo "Configuration updated. Reboot needed for full disable."
echo "Current session is in $(getenforce) mode."
Enter fullscreen mode Exit fullscreen mode

Understanding SELinux Modes

Mode Description Behavior
Enforcing SELinux is active and enforcing security policies Access denied if not allowed
Permissive SELinux is active but only logs violations Access allowed, but violations logged
Disabled SELinux is completely turned off No SELinux checks or logging

SELinux Status Overview 

# View the current SELinux status
getenforce

# View detailed SELinux status
sestatus

# View SELinux config file
cat /etc/selinux/config

# Explanation of the config file:
# SELINUX=enforcing|permissive|disabled  - Sets the mode
# SELINUXTYPE=targeted|mls|minimum       - Sets the policy type
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "No package selinux-policy available": 
   # Try installing with different package names
   yum install -y selinux-policy-targeted selinux-policy
   # For Ubuntu/Debian
   apt-get install -y selinux-basics selinux-policy-default
Enter fullscreen mode Exit fullscreen mode
  1. "Permission denied" when editing config: 
   # Use sudo or become root
   sudo su -
Enter fullscreen mode Exit fullscreen mode
  1. "setenforce: SELinux is disabled": 
   # SELinux is already disabled in config, but currently in enforcing/permissive
   # Just reboot to fully disable
   # Or set to permissive temporarily
Enter fullscreen mode Exit fullscreen mode
  1. Config changes not taking effect: 
   # Check the config file content
   cat /etc/selinux/config
   # Ensure there are no duplicate entries
   # If duplicate, remove old entries
Enter fullscreen mode Exit fullscreen mode
  1. Need to temporarily re-enable SELinux: 
   # To test with SELinux enabled temporarily
   setenforce 1
   # Or permanently enable
   sed -i 's/SELINUX=disabled/SELINUX=enforcing/g' /etc/selinux/config
Enter fullscreen mode Exit fullscreen mode

Complete Script (Run from Jump Host) 

#!/bin/bash

echo "========================================="
echo "Installing SELinux and Disabling it Permanently"
echo "========================================="

ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo ""
echo "=== Step 1: Installing SELinux Packages ==="
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

echo ""
echo "=== Step 2: Checking Current Status ==="
echo "Current mode: $(getenforce)"
echo "Config mode: $(grep ^SELINUX= /etc/selinux/config 2>/dev/null | cut -d= -f2)"

echo ""
echo "=== Step 3: Disabling SELinux Permanently ==="
# Backup original config
cp /etc/selinux/config /etc/selinux/config.backup

# Modify SELINUX setting
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
sed -i "s/SELINUX=permissive/SELINUX=disabled/g" /etc/selinux/config

# Ensure it's set to disabled
if ! grep -q "^SELINUX=disabled" /etc/selinux/config; then
    sed -i "s/^SELINUX=.*/SELINUX=disabled/g" /etc/selinux/config
fi

echo ""
echo "=== Step 4: Verifying Configuration ==="
grep ^SELINUX= /etc/selinux/config

echo ""
echo "=== Step 5: Setting Current Session to Permissive ==="
setenforce 0

echo ""
echo "=== Step 6: Final Status ==="
echo "Current mode: $(getenforce)"
echo "Config mode: $(grep ^SELINUX= /etc/selinux/config | cut -d= -f2)"

echo ""
echo "========================================="
echo "✅ SELinux configuration completed!"
echo "📌 Current mode: $(getenforce)"
echo "📌 After reboot: Disabled"
echo "📌 Config file: /etc/selinux/config"
echo "📌 Backup file: /etc/selinux/config.backup"
echo "========================================="
'
EOF
Enter fullscreen mode Exit fullscreen mode

Make it executable and run:

chmod +x setup_selinux.sh
./setup_selinux.sh
Enter fullscreen mode Exit fullscreen mode

Important Notes

  1. No reboot required: The task specifically says no reboot is needed
  2. Current vs After Reboot:
    • Current status may still show enforcing or permissive
    • After reboot, SELinux will be fully disabled
  3. Setenforce 0: This sets SELinux to permissive mode until reboot
  4. Configuration file: /etc/selinux/config controls the permanent setting
  5. Backup created: Always good to backup configuration before changes

Complete Solution Summary

SELinux has been configured on App Server 2 (stapp02):

  • ✅ SELinux packages installed: selinux-policy, selinux-policy-targeted, libselinux-utils
  • ✅ Configuration updated: /etc/selinux/config set to SELINUX=disabled
  • ✅ Current session set to permissive: setenforce 0 (optional but helpful)
  • ✅ Verified configuration: grep ^SELINUX= /etc/selinux/config
  • ✅ No reboot performed: As per requirements
  • ✅ After reboot: SELinux will be completely disabled

The server is now configured with SELinux packages installed and permanently disabled. After tonight's scheduled maintenance reboot, SELinux will be fully disabled on App Server 2.

Top comments (0)