啟動、關閉與觀察

1. SELinux 開機啟動模式

   [root@kvm8 ~]# vi /etc/selinux/config 
   [root@kvm8 ~]# cat /etc/selinux/config 
   # This file controls the state of SELinux on the system.
   # SELINUX= can take one of these three values:
   #     enforcing - SELinux security policy is enforced.
   #     permissive - SELinux prints warnings instead of enforcing.
   #     disabled - No SELinux policy is loaded.
   # See also:
   # https://docs.fedoraproject.org/en-US/quick-docs/
   #getting-started-with-selinux/#getting-started-with-selinux-selinux-states-and-modes
   #
   # NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also
   # fully disable SELinux during boot. If you need a system with SELinux
   # fully disabled instead of SELinux running with no policy loaded, you
   # need to pass selinux=0 to the kernel command line. You can use grubby
   # to persistently set the bootloader to boot with selinux=0:
   #
   #    grubby --update-kernel ALL --args selinux=0
   #
   # To revert back to SELinux enabled:
   #
   #    grubby --update-kernel ALL --remove-args selinux
   #
   SELINUX=enforcing
   # SELINUXTYPE= can take one of these three values:
   #     targeted - Targeted processes are protected,
   #     minimum - Modification of targeted policy. Only selected processes are protected.
   #     mls - Multi Level Security protection.
   SELINUXTYPE=targeted
   

2. 觀察目前 SELinux 狀態，設定檔及目前狀態皆為 enforcing。

   [root@kvm8 ~]# sestatus
   SELinux status:                 enabled
   SELinuxfs mount:                /sys/fs/selinux
   SELinux root directory:         /etc/selinux
   Loaded policy name:             targeted
   Current mode:                   enforcing
   Mode from config file:          enforcing
   Policy MLS status:              enabled
   Policy deny_unknown status:     allowed
   Memory protection checking:     actual (secure)
   Max kernel policy version:      33
   

3. getenforce 取得目前 SELinux 狀態 Enforcing

   [root@kvm8 ~]# getenforce
   Enforcing
   

4. setenforce 關閉 SELinux

   [root@kvm8 ~]# setenforce 0
   

5. getenforce 再查得目前 SELinux 狀態 Permissive

   [root@kvm8 ~]# getenforce
   Permissive
   

6. setenforce 再開啟 SELinux

   [root@kvm8 ~]# setenforce 1