fedora-docs-l10n/quick-docs/master/pages/selinux-changing-states-and-modes — English @ Fedora Weblate: $ *cat /proc/cmdline* BOOT

Zen

	English	Actions
	Permanent changes in SELinux states and modes
	As discussed in xref:selinux-getting-started.adoc#_SELinux_states_and_modes[Getting started with SELinux] SELinux can be enabled or disabled. When enabled, SELinux has two modes: enforcing and permissive.
	Use the [command]`getenforce` or [command]`sestatus` commands to check in which mode SELinux is running. The [command]`getenforce` command returns `Enforcing`, `Permissive`, or `Disabled`.
	The [command]`sestatus` command returns the SELinux status and the SELinux policy being used:
	[~]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31
	When systems run SELinux in permissive mode, users and processes can label various file-system objects incorrectly. File-system objects created while SELinux is disabled are not labeled at all. This behavior causes problems when changing to enforcing mode because SELinux relies on correct labels of file-system objects.
	To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from the disabled state to permissive or enforcing mode. In permissive mode, use the [command]`fixfiles -F onboot` command as root to create `/.autorelabel` file containing the `-F` option to ensure that files are relabeled upon next reboot.
	Enabling SELinux
	When enabled, SELinux can run in one of two modes: enforcing or permissive. The following sections show how to permanently change into these modes.
	While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, follow this procedure.
	Prerequisites
	The [package]`selinux-policy-targeted`, [package]`selinux-policy`, [package]`libselinux-utils`, and [package]`grubby` packages are installed. To check that a particular package is installed:
	$ rpm -q _package_name_
	Procedure
	If your system has SELinux disabled at the kernel level (this is the recommended way, see xref:changing-selinux-states-and-modes.adoc#_disabling_selinux[]), change this first. Check if you have the `selinux=0` option in your kernel command line:
	$ cat /proc/cmdline BOOT_IMAGE=... ... selinux=0
	Remove the `selinux=0` option from the bootloader configuration using [command]`grubby`:
	$ sudo grubby --update-kernel ALL --remove-args selinux
	The change applies after you restart the system in one of the following steps.
	Ensure the file system is relabeled on the next boot:
	$ sudo fixfiles onboot
	Enable SELinux in permissive mode. For more information, see xref:changing-selinux-states-and-modes.adoc#_changing_to_permissive_mode[].
	Restart your system:
	$ reboot
	Check for SELinux denial messages.
	$ sudo ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent
	If there are no denials, switch to enforcing mode. For more information, see xref:changing-selinux-states-and-modes.adoc#_changing_to_enforcing_mode[].
	To run custom applications with SELinux in enforcing mode, choose one of the following scenarios:
	Run your application in the `unconfined_service_t` domain.
	Write a new policy for your application. See the link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux[Writing a custom SELinux policy] chapter in the link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/index[RHEL 8 Using SELinux] document for more information.
	Changing to permissive mode

Loading…

None

String updated in the repository

English

English 51 characters edited Current translation Read only

a year ago

Browse all string changes

Things to check

Ellipsis

The string uses three dots (...) instead of an ellipsis character (…)

Reset

Glossary

English	English
No related strings found in the glossary.

String information

Source string description

type: delimited block -

Flags

no-wrap, read-only

Source string location

./pages/selinux-changing-states-and-modes.adoc:68

String age

a year ago

Last updated

a year ago

Source string age

a year ago

Translation file

pot/master/pages/selinux-changing-states-and-modes.pot, string 18

Shortcut	Action
`?`	Open available keyboard shortcuts.
`Alt` + `Home`	Navigate to the first translation in the current search.
`Alt` + `End`	Navigate to the last translation in the current search.
`Alt` + `PageUp` or `Ctrl` + `↑` or `Alt` + `↑` or `Cmd` + `↑` or	Navigate to the last translation in the current search.
`Alt` + `PageDown` or `Ctrl` + `↓` or `Alt` + `↓` or `Cmd` + `↓` or	Navigate to the next translation in the current search.
`Ctrl` + `Enter` or `Cmd` + `Enter`	Submit current form; this works the same as pressing Save and continue while editing translation.
`Ctrl` + `Shift` + `Enter` or `Cmd` + `Shift` +`Enter`	Unmark translation as Needing edit and submit it.
`Alt` + `Enter` or `Option` + `Enter`	Submit the string as a suggestion; this works the same as pressing Suggest while editing translation.
`Ctrl` + `E` or `Cmd` + `E`	Focus on translation editor.
`Ctrl` + `U` or `Cmd` + `U`	Focus on comment editor.
`Ctrl` + `M` or `Cmd` + `M`	Shows Automatic suggestions tab.
`Ctrl` + `1` to `Ctrl` + `9` or `Cmd` + `1` to `Cmd` + `9`	Copies placeable of a given number from source string.
`Ctrl` + `M` followed by `1` to `9` or `Cmd` + `M` followed by `1` to `9`	Copy the machine translation of a given number to current translation.
`Ctrl` + `I` followed by `1` to `9` or `Cmd` + `I` followed by `1` to `9`	Ignore one item in the list of failing checks.
`Ctrl` + `J` or `Cmd` + `J`	Shows the Nearby strings tab.
`Ctrl` + `S` or `Cmd` + `S`	Focus on search field.
`Ctrl` + `O` or `Cmd` + `O`	Copy the source string.
`Ctrl` + `Y` or `Cmd` + `Y`	Toggle the Needs editing checkbox.
`→`	Browse the next translation string.
`←`	Browse the previous translation string.

fedora-docs-l10n/quick-docs

master/pages/selinux-changing-states-and-modes

English

Translate

Source string Source string

Things to check

Ellipsis

Glossary

String information

Source string description

Flags

Source string location

String age

Last updated

Source string age

Translation file