How to change SELinux mode
SELinux的三种模式为enforcing、permissive和disabled,查看当前状态可用sestatus或getenforce命令;临时切换模式可用setenforce 0(permissive)或setenforce 1(enforcing),但重启后失效;永久更改需编辑/etc/selinux/config文件并重启系统;推荐优先使用permissive模式以兼顾排错与安全,操作前应检查日志、考虑兼容性,并在切换后可能需要恢复文件上下文标签。
SELinux 有三种常见模式:enforcing(强制模式)、permissive(宽容模式)和disabled(禁用)。改变 SELinux 模式通常是为了调试、排查权限问题,或者在某些环境下让系统行为更宽松。但要注意,修改 SELinux 模式可能影响系统安全性。
查看当前 SELinux 状态
在修改之前,先确认当前的 SELinux 模式:
sestatus
或者:
getenforce
这两个命令都能告诉你当前 SELinux 是 enforcing、permissive 还是 disabled。
如果你看到输出是 Enforcing
,说明 SELinux 正在积极限制访问;如果是 Permissive
,它只会记录违规行为而不阻止;Disabled
就是完全关掉了。
临时切换 SELinux 模式
如果你只是想临时切换一下模式(比如为了测试某个服务是否受 SELinux 影响),可以用以下命令:
切换到 permissive 模式:
sudo setenforce 0
切换回 enforcing 模式:
sudo setenforce 1
⚠️ 注意:这个方法只在当前运行时生效,重启后会恢复为配置文件中设定的模式。
永久更改 SELinux 模式
要永久更改 SELinux 模式,需要编辑它的配置文件:
sudo vi /etc/selinux/config
找到这行:
SELINUX=enforcing
改成你需要的模式:
SELINUX=enforcing
SELINUX=permissive
SELINUX=disabled
保存退出后,重启系统使更改生效:
sudo reboot
✅ 推荐做法:除非你确实不需要 SELinux,否则建议优先使用
permissive
而不是直接disabled
,这样可以在不影响安全机制的前提下收集日志用于排错。
改模式前需要注意什么?
- 日志查看:进入 permissive 模式后,可以检查
/var/log/audit/audit.log
或用ausearch
命令查看 SELinux 的拒绝记录。 - 系统兼容性:有些应用或脚本可能默认关闭 SELinux 来避免权限问题,但这不一定是最佳实践。
- 恢复上下文:如果你从 enforcing 切换到 permissive 再切回去,有时候需要手动恢复文件上下文标签:
sudo touch /.autorelabel && sudo reboot
基本上就这些。改 SELinux 模式本身不复杂,但容易忽略对系统安全性和后续日志分析的影响,操作前最好搞清楚目的。
The above is the detailed content of How to change SELinux mode. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

The steps to install Docker include updating the system and installing dependencies, adding GPG keys and repositories, installing the Docker engine, configuring user permissions, and testing the run. 1. First execute sudoaptupdate and sudoaptupgrade to update the system; 2. Install apt-transport-https, ca-certificates and other dependency packages; 3. Add the official GPG key and configure the warehouse source; 4. Run sudoaptinstall to install docker-ce, docker-ce-cli and containerd.io; 5. Add the user to the docker group to avoid using sudo; 6. Finally, dock

To restart the service managed by systemctl in Linux, 1. First use the systemctlstatus service name to check the status and confirm whether it is necessary to restart; 2. Use the sudosystemctlrestart service name command to restart the service, and ensure that there is administrator privileges; 3. If the restart fails, you can check whether the service name is correct, whether the configuration file is wrong, or whether the service is installed successfully; 4. Further troubleshooting can be solved by viewing the log journalctl-u service name, stopping and starting the service first, or trying to reload the configuration.

Bash scripts handle command line parameters through special variables. Use $1, $2, etc. to get positional parameters, where $0 represents the script name; iterates through "$@" or "$*", the former retains space separation, and the latter is merged into a single string; use getopts to parse options with parameters (such as -a, -b:value), where the option is added to indicate the parameter value; at the same time, pay attention to referring to variables, using shift to move the parameter list, and obtaining the total number of parameters through $#.

The shutdown command of Linux/macOS can be shut down, restarted, and timed operations through parameters. 1. Turn off the machine immediately and use sudoshutdownnow or -h/-P parameters; 2. Use the time or specific time point for the shutdown, cancel the use of -c; 3. Use the -r parameters to restart, support timed restart; 4. Pay attention to the need for sudo permissions, be cautious in remote operation, and avoid data loss.

ping is the basic tool for judging network connection status. The usage method is as follows: 1. Open the command line tool (cmd for Windows, Terminal for macOS/Linux); 2. Enter the ping command to add the target address, such as pingwww.example.com or ping8.8.8.8; 3. You can add parameters to limit the number of times, such as -n for Windows, and -c for macOS/Linux. The normal response displays time, packet loss may indicate a network problem, the timeout may be caused by firewall intercept or the host is not online, the unreachable prompts an abnormality in the local network, and if the domain name resolution fails, DNS needs to be checked. Although practical, some servers block pings, which can be accessed by browsers or tr

To view the status of services in Linux system, 1. Use systemctl to view all service status, pay attention to the UNIT and ACTIVE columns to determine whether the service is running; 2. Use systemctlstatus to view the detailed status of specific services, including operation status, PID and log summary; 3. View the service logs through journalctl-u, and locate issues in combination with the -f, --since or -n parameters; handling of common problems includes starting the service, checking the configuration, checking the cause of the crash and setting up the startup. Mastering these commands can effectively manage and troubleshoot service problems.

vmstat is a tool in Linux for monitoring system performance, which can view memory, CPU, IO, and process status. Run vmstat to output system snapshots, and add parameters such as vmstat2 to refresh every 2 seconds; common parameters include -s (summary), -d (disk statistics), and -p (partition information). The output is divided into fields such as procs(r, b), memory(swpd, free, buff, cache), swap(si, so), io(bi, bo), system(in, cs), cpu(us, sy, id, wa) and so on. In actual combat, if the r value is greater than the number of CPU cores, it may be overloaded. High Wa indicates the IO bottleneck, and continuous so does not mean that the memory is tight.

To create a file system, you need to use the mkfs command, and its basic format is sudomkfs. File system type partition path, such as sudomkfs.ext4/dev/sdb1; common supported file systems include ext4, vfat, ntfs, xfs, etc.; you can use -L to set volume labels, -c to check bad blocks and other options to enhance operation flexibility; at the same time, you can also use graphics tools such as GParted or Disks to simplify the process, but you must confirm the partition path before operation to avoid accidentally deletion of data.
