Cause
Due to PCI recommendations, SELinux is activated at the system boot loader time. This
must match the expected SELinux command file.
 | Note: |
|
Avaya does not recommend disabling SELinux as doing so can lower its security and
remove it from PCI compliance. However, if required, use the following procedure to
ensure the system reboots without stopping.
|
Solution
-
To disable SELinux, do the following:
-
Run the following commands as root on a command line:
grubby --update-kernel=ALL --remove-args="selinux=1" --args="selinux=0"
grubby --update-kernel=ALL --remove-args="enforcing=1" --args="enforcing=0"
sed -i '/^SELINUX=/ s/\(enforcing\|permissive\)/disabled/' /etc/selinux/config
reboot
-
Log back in and test the status by running the sestatus
command.
# sestatus
SELinux status: disabled
-
To enable SELinux, do the following:
-
Run the following commands as root on a command line:
grubby --update-kernel=ALL --remove-args="selinux=0" --args="selinux=1"
grubby --update-kernel=ALL --remove-args="enforcing=0" --args="enforcing=1"
sed -i '/^SELINUX=/ s/\(disabled\|permissive\)/enforcing/' /etc/selinux/config
reboot
This may take a while to re-label the files on the disk. The system
automatically reboots when done.
-
Log back in and test the status by running the sestatus
command.
# sestatus
SELinux status: enabled
Loaded policy name: targeted
Current mode: enforcing
-
To set SELinux to permissive, do the following:
-
Run the following commands as root on a command line:
grubby --update-kernel=ALL --remove-args="selinux=0" --args="selinux=1"
grubby --update-kernel=ALL --remove-args="enforcing=1" --args="enforcing=0"
sed -i '/^SELINUX=/ s/\(disabled\|enforcing\)/permissive/' /etc/selinux/config
reboot
This may take a while to re-label the files on the disk. The system
automatically reboots when done.
-
Log back in and test the status by running the sestatus
command.
# sestatus
SELinux status: enabled
Loaded policy name: targeted
Current mode: permissive
