如何关闭 CentOS7 SELinux

Bertha 。 2022-01-14 06:21 307阅读 0赞

[2019独角兽企业重金招聘Python工程师标准>>> ][2019_Python_] ![hot3.png][]

首先检查SELinux状态。如下所示：

#开启状态
    #SELinux status:                 enabled
    [root@localhost ~]# sestatus 
    SELinux status:                 enabled
    SELinuxfs mount:                /sys/fs/selinux
    SELinux root directory:         /etc/selinux
    Loaded policy name:             targeted
    Current mode:                   enforcing
    Mode from config file:          enforcing
    Policy MLS status:              enabled
    Policy deny_unknown status:     allowed
    Max kernel policy version:      31
    [root@localhost ~]# sestatus -v
    SELinux status:                 enabled
    SELinuxfs mount:                /sys/fs/selinux
    SELinux root directory:         /etc/selinux
    Loaded policy name:             targeted
    Current mode:                   enforcing
    Mode from config file:          enforcing
    Policy MLS status:              enabled
    Policy deny_unknown status:     allowed
    Max kernel policy version:      31
    
    Process contexts:
    Current context:                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
    Init context:                   system_u:system_r:init_t:s0
    /usr/sbin/sshd                  system_u:system_r:sshd_t:s0-s0:c0.c1023
    
    File contexts:
    Controlling terminal:           unconfined_u:object_r:user_devpts_t:s0
    /etc/passwd                     system_u:object_r:passwd_file_t:s0
    /etc/shadow                     system_u:object_r:shadow_t:s0
    /bin/bash                       system_u:object_r:shell_exec_t:s0
    /bin/login                      system_u:object_r:login_exec_t:s0
    /bin/sh                         system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
    /sbin/agetty                    system_u:object_r:getty_exec_t:s0
    /sbin/init                      system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
    /usr/sbin/sshd                  system_u:object_r:sshd_exec_t:s0
    [root@localhost ~]#

我们只需要查看SELinux status 值即可，推荐关闭SELinux。

也可以通过 getenforce 命令查看。

[root@localhost ~]# getenforce 
    Enforcing

SELinux可以临时或永久关闭。

临时关闭方法，有两种选择如下：

[root@localhost ~]# setenforce 0
    [root@localhost ~]# sestatus -v
    SELinux status:                 enabled
    SELinuxfs mount:                /sys/fs/selinux
    SELinux root directory:         /etc/selinux
    Loaded policy name:             targeted
    Current mode:                   permissive
    Mode from config file:          enforcing
    Policy MLS status:              enabled
    Policy deny_unknown status:     allowed
    Max kernel policy version:      31
    
    Process contexts:
    Current context:                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
    Init context:                   system_u:system_r:init_t:s0
    /usr/sbin/sshd                  system_u:system_r:sshd_t:s0-s0:c0.c1023
    
    File contexts:
    Controlling terminal:           unconfined_u:object_r:user_devpts_t:s0
    /etc/passwd                     system_u:object_r:passwd_file_t:s0
    /etc/shadow                     system_u:object_r:shadow_t:s0
    /bin/bash                       system_u:object_r:shell_exec_t:s0
    /bin/login                      system_u:object_r:login_exec_t:s0
    /bin/sh                         system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
    /sbin/agetty                    system_u:object_r:getty_exec_t:s0
    /sbin/init                      system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
    /usr/sbin/sshd                  system_u:object_r:sshd_exec_t:s0

永久关闭方法如下

#查看selinux config 文件
    [root@localhost ~]# cat /etc/selinux/config 
    
    # This file controls the state of SELinux on the system.
    # SELINUX= can take one of these three values:
    #     enforcing - SELinux security policy is enforced.
    #     permissive - SELinux prints warnings instead of enforcing.
    #     disabled - No SELinux policy is loaded.
    SELINUX=enforcing
    # SELINUXTYPE= can take one of three values:
    #     targeted - Targeted processes are protected,
    #     minimum - Modification of targeted policy. Only selected processes are protected. 
    #     mls - Multi Level Security protection.
    SELINUXTYPE=targeted 
    
    
    [root@localhost ~]#

修改SELINUX=disabled ，重启主机即可生效。

转载于:https://my.oschina.net/u/1011130/blog/3013345

[2019_Python_]: https://my.oschina.net/u/2663968/blog/3061697
[hot3.png]: /images/20220114/5f8c5f1a8187459faaed13efb06070ef.png