How to Disable SELinux on Fedora Linux 39

[Linux Hint]

SELinux provides an extreme level of security to Fedora Linux 39. Often, this causes extra headaches since SELinux being too strict makes running the different services on Fedora Linux 39 very hard. That’s one reason that you might be thinking of disabling SELinux.

Another reason we can think of disabling SELinux is when you’re running Fedora Linux 39 on single-board computers (SBCs) like Raspberry Pis. Since these mini-computers have limited resources, disabling SELinux will improve the performance a bit.

We do not recommend disabling SELinux completely and leaving your system unprotected. But if it’s a test computer, a single-board computer (SBC) with limited resources, or just a computer in a private network that is not accessible from the outside in any way, you can disable SELinux.

In this article, we will show you how to disable SELinux completely on Fedora 39 in case you need it.

Topic of Contents:

1. Checking the Current Status of SELinux
2. Changing the SELinux Modes
3. Disabling SELinux Completely Using the Kernel Boot Parameter
4. Checking Whether SELinux Is Disabled
5. Enabling SELinux Again
6. Conclusion

Checking the Current Status of SELinux

To check the current status of SELinux, run the following command:

$ getenforce

As you can see, SELinux is in “Enforcing” mode. This is the default mode of SELinux on Fedora 39. In this mode, SELinux is fully active and working.

Changing the SELinux Modes

SELinux has two modes: “Enforcing” mode and “Permissive” mode.

In “Enforcing” mode, SELinux enforces its security policies. In “Permissive” mode, SELinux only logs warnings; it does not enforce any policies. So, in “Permissive” mode, SELinux will let you do things just the way you would if it’s disabled.

Instead of disabling SELinux completely, you can set it to “Permissive” mode unless you have something else in mind.

To set SELinux to “Permissive” mode, run the following command:

$ sudo sed -i 's/^SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config

For the changes to take effect, reboot your Fedora system:

$ sudo reboot

As you can see, SELinux is set to “Permissive” mode.

$ getenforce

You can change back SELinux to “Enforcing” mode with the following command:

$ sudo sed -i 's/^SELINUX=permissive/SELINUX=enforcing/g' /etc/selinux/config

Then, reboot your computer for the changes to take effect.

$ sudo reboot

Disabling SELinux Completely Using the Kernel Boot Parameter

To disable SELinux completely on Fedora 39 using the kernel boot parameter, run the following command:

$ sudo grubby --update-kernel ALL --args 'selinux=0'

As you can see, the “selinux=0” kernel boot parameter is set for all the available GRUB boot entries of Fedora 39.

$ sudo grubby --info ALL

For the changes to take effect, reboot your computer.

$ sudo reboot

Checking Whether SELinux Is Disabled

To check whether SELinux is disabled, run the following command:

$ getenforce

As you can see, SELinux is disabled.

Enabling SELinux Again

To enable SELinux again, remove the “selinux=0” kernel boot parameter with the following command:

$ sudo grubby --update-kernel ALL --remove-args 'selinux=0'

As you can see, the “selinux=0” kernel boot parameter is removed from all the GRUB boot entries of Fedora 39.

$ sudo grubby --info ALL

For the changes to take effect, reboot your computer.

$ sudo reboot

Once your computer boots, SELinux should be enabled as you can see in the following screenshot:

$ getenforce

Conclusion

In this article, we showed you how to change the SELinux modes (from “enforcing” to “permissive” and vice-versa) on Fedora 39. We also showed you how to disable SELinux completely on Fedora 39 using the “selinux=0” kernel parameter and how to re-enable SELinux on Fedora 39 as well.

View the full article