Table of Contents
查看当前 SELinux 状态
临时切换 SELinux 模式
永久更改 SELinux 模式
改模式前需要注意什么?

How to change SELinux mode

Jul 02, 2025 am 12:06 AM

SELinux的三种模式为enforcing、permissive和disabled,查看当前状态可用sestatus或getenforce命令;临时切换模式可用setenforce 0(permissive)或setenforce 1(enforcing),但重启后失效;永久更改需编辑/etc/selinux/config文件并重启系统;推荐优先使用permissive模式以兼顾排错与安全,操作前应检查日志、考虑兼容性,并在切换后可能需要恢复文件上下文标签。

How to change SELinux mode

SELinux 有三种常见模式:enforcing(强制模式)、permissive(宽容模式)和disabled(禁用)。改变 SELinux 模式通常是为了调试、排查权限问题,或者在某些环境下让系统行为更宽松。但要注意,修改 SELinux 模式可能影响系统安全性。


查看当前 SELinux 状态

在修改之前,先确认当前的 SELinux 模式:

sestatus

或者:

getenforce

这两个命令都能告诉你当前 SELinux 是 enforcing、permissive 还是 disabled。

如果你看到输出是 Enforcing,说明 SELinux 正在积极限制访问;如果是 Permissive,它只会记录违规行为而不阻止;Disabled 就是完全关掉了。


临时切换 SELinux 模式

如果你只是想临时切换一下模式(比如为了测试某个服务是否受 SELinux 影响),可以用以下命令:

  • 切换到 permissive 模式:

    sudo setenforce 0
  • 切换回 enforcing 模式:

    sudo setenforce 1

⚠️ 注意:这个方法只在当前运行时生效,重启后会恢复为配置文件中设定的模式。


永久更改 SELinux 模式

要永久更改 SELinux 模式,需要编辑它的配置文件:

sudo vi /etc/selinux/config

找到这行:

SELINUX=enforcing

改成你需要的模式:

  • SELINUX=enforcing
  • SELINUX=permissive
  • SELINUX=disabled

保存退出后,重启系统使更改生效:

sudo reboot

✅ 推荐做法:除非你确实不需要 SELinux,否则建议优先使用 permissive 而不是直接 disabled,这样可以在不影响安全机制的前提下收集日志用于排错。


改模式前需要注意什么?

  • 日志查看:进入 permissive 模式后,可以检查 /var/log/audit/audit.log 或用 ausearch 命令查看 SELinux 的拒绝记录。
  • 系统兼容性:有些应用或脚本可能默认关闭 SELinux 来避免权限问题,但这不一定是最佳实践。
  • 恢复上下文:如果你从 enforcing 切换到 permissive 再切回去,有时候需要手动恢复文件上下文标签:
    sudo touch /.autorelabel && sudo reboot

    基本上就这些。改 SELinux 模式本身不复杂,但容易忽略对系统安全性和后续日志分析的影响,操作前最好搞清楚目的。

    The above is the detailed content of How to change SELinux mode. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

PHP Tutorial
1503
276
How to install Docker on Linux How to install Docker on Linux Jul 09, 2025 am 12:09 AM

The steps to install Docker include updating the system and installing dependencies, adding GPG keys and repositories, installing the Docker engine, configuring user permissions, and testing the run. 1. First execute sudoaptupdate and sudoaptupgrade to update the system; 2. Install apt-transport-https, ca-certificates and other dependency packages; 3. Add the official GPG key and configure the warehouse source; 4. Run sudoaptinstall to install docker-ce, docker-ce-cli and containerd.io; 5. Add the user to the docker group to avoid using sudo; 6. Finally, dock

How to restart a service using systemctl How to restart a service using systemctl Jul 12, 2025 am 12:38 AM

To restart the service managed by systemctl in Linux, 1. First use the systemctlstatus service name to check the status and confirm whether it is necessary to restart; 2. Use the sudosystemctlrestart service name command to restart the service, and ensure that there is administrator privileges; 3. If the restart fails, you can check whether the service name is correct, whether the configuration file is wrong, or whether the service is installed successfully; 4. Further troubleshooting can be solved by viewing the log journalctl-u service name, stopping and starting the service first, or trying to reload the configuration.

How to process command line arguments in bash How to process command line arguments in bash Jul 13, 2025 am 12:02 AM

Bash scripts handle command line parameters through special variables. Use $1, $2, etc. to get positional parameters, where $0 represents the script name; iterates through "$@" or "$*", the former retains space separation, and the latter is merged into a single string; use getopts to parse options with parameters (such as -a, -b:value), where the option is added to indicate the parameter value; at the same time, pay attention to referring to variables, using shift to move the parameter list, and obtaining the total number of parameters through $#.

How to use the `shutdown` command How to use the `shutdown` command Jul 15, 2025 am 12:26 AM

The shutdown command of Linux/macOS can be shut down, restarted, and timed operations through parameters. 1. Turn off the machine immediately and use sudoshutdownnow or -h/-P parameters; 2. Use the time or specific time point for the shutdown, cancel the use of -c; 3. Use the -r parameters to restart, support timed restart; 4. Pay attention to the need for sudo permissions, be cautious in remote operation, and avoid data loss.

How to check network connectivity using ping How to check network connectivity using ping Jul 11, 2025 am 12:32 AM

ping is the basic tool for judging network connection status. The usage method is as follows: 1. Open the command line tool (cmd for Windows, Terminal for macOS/Linux); 2. Enter the ping command to add the target address, such as pingwww.example.com or ping8.8.8.8; 3. You can add parameters to limit the number of times, such as -n for Windows, and -c for macOS/Linux. The normal response displays time, packet loss may indicate a network problem, the timeout may be caused by firewall intercept or the host is not online, the unreachable prompts an abnormality in the local network, and if the domain name resolution fails, DNS needs to be checked. Although practical, some servers block pings, which can be accessed by browsers or tr

How to check systemctl status How to check systemctl status Jul 09, 2025 am 12:12 AM

To view the status of services in Linux system, 1. Use systemctl to view all service status, pay attention to the UNIT and ACTIVE columns to determine whether the service is running; 2. Use systemctlstatus to view the detailed status of specific services, including operation status, PID and log summary; 3. View the service logs through journalctl-u, and locate issues in combination with the -f, --since or -n parameters; handling of common problems includes starting the service, checking the configuration, checking the cause of the crash and setting up the startup. Mastering these commands can effectively manage and troubleshoot service problems.

How to use the vmstat command How to use the vmstat command Jul 11, 2025 am 12:41 AM

vmstat is a tool in Linux for monitoring system performance, which can view memory, CPU, IO, and process status. Run vmstat to output system snapshots, and add parameters such as vmstat2 to refresh every 2 seconds; common parameters include -s (summary), -d (disk statistics), and -p (partition information). The output is divided into fields such as procs(r, b), memory(swpd, free, buff, cache), swap(si, so), io(bi, bo), system(in, cs), cpu(us, sy, id, wa) and so on. In actual combat, if the r value is greater than the number of CPU cores, it may be overloaded. High Wa indicates the IO bottleneck, and continuous so does not mean that the memory is tight.

How to create a filesystem mkfs How to create a filesystem mkfs Jul 12, 2025 am 12:56 AM

To create a file system, you need to use the mkfs command, and its basic format is sudomkfs. File system type partition path, such as sudomkfs.ext4/dev/sdb1; common supported file systems include ext4, vfat, ntfs, xfs, etc.; you can use -L to set volume labels, -c to check bad blocks and other options to enhance operation flexibility; at the same time, you can also use graphics tools such as GParted or Disks to simplify the process, but you must confirm the partition path before operation to avoid accidentally deletion of data.

See all articles