selinux_config(5)

💖 selinux_config(5) 💖

okay bestie, so this is the page for selinux_config, aka the SELinux configuration file — and it's genuinely the main character of your whole SELinux setup, no cap. Let's get into it 🫶

---

✨ NAME ✨

config — the SELinux sub-system configuration file. that's it, that's the name, short and iconic 💅

---

🌸 DESCRIPTION 🌸

okay so the SELinux config file? it's the vibe-setter. it controls the state of SELinux regarding, like, four whole things:

1. the policy enforcement status — enforcing, permissive, or disabled. it's giving "are we actually doing this or not" 🎀
2. the policy name or type that forms a path to the policy that's gonna get loaded, plus its supporting configuration files. so like, where the policy lives 📁
3. how SELinux-aware login applications should behave if there are no valid SELinux users configured. awkward silence behavior, basically 😭
4. whether the system is gonna be relabeled or not. the glow-up question ✨

all the entries controlling these functions are described down in the FILE FORMAT section, keep scrolling bestie 👇

the fully qualified path name of the SELinux configuration file is:

/etc/selinux/config

real talk though: if the config file is missing or corrupt, then no SELinux policy is loaded (i.e. SELinux is disabled). that's the whole system just not doing SELinux, so like, be careful okay?? 💀

and if you ever need to find where the config file is, the sestatus (8) command and the libselinux function selinux_path (3) will return the location of the config file. love that for us 🔍

---

🦋 FILE FORMAT 🦋

the config file supports the following parameters:

SELINUX = enforcing | permissive | disabled
SELINUXTYPE = policy_name
REQUIRESEUSERS = 0 | 1
AUTORELABEL = 0 | 1

where:

👑 SELINUX

this entry can contain one of three values:

• enforcing — SELinux security policy is enforced. the rules are the rules, periodt 🔥
• permissive — SELinux security policy is not enforced but it logs the warnings (i.e. the action is allowed to proceed). it's just watching and taking notes, very "not mad, just disappointed" 📝
• disabled — no SELinux policy is loaded. ngl this option was used to disable SELinux completely, which is now deprecated. use the selinux=0 kernel boot option instead (see selinux(8)). do not come for me, I'm just the messenger 🚫

the entry can be determined using the sestatus(8) command or selinux_getenforcemode(3).

🎀 SELINUXTYPE

the policy_name entry is used to identify the policy type, and it becomes the directory name of where the policy and its configuration files are located.

the entry can be determined using the sestatus(8) command or selinux_getpolicytype(3).

the policy_name is relative to a path that is defined within the SELinux subsystem, and that path can be retrieved by using selinux_path(3). an example entry retrieved by selinux_path(3) is:

/etc/selinux/

the policy_name is then appended to this and becomes the 'policy root' location, which can be retrieved by selinux_policy_root_path(3). an example entry retrieved is:

/etc/selinux/targeted

the actual binary policy is located relative to this directory and also has a policy name pre-allocated. this information can be retrieved using selinux_binary_policy_path(3). an example entry retrieved by selinux_binary_policy_path(3) is:

/etc/selinux/targeted/policy/policy

the binary policy name has, by convention, the SELinux policy version that it supports appended to it. the maximum policy version supported by the kernel can be determined using the sestatus(8) command or security_policyvers(3). an example binary policy file with the version is:

/etc/selinux/targeted/policy/policy.24

🧚 REQUIRESEUSERS

this optional entry can be used to fail a login if there's no matching or default entry in the seusers(5) file, or if the seusers file is just straight up missing. rude, but okay 🙈

it's checked by getseuserbyname(3), which is called by SELinux-aware login applications such as PAM(8).

if set to 0 or the entry is missing:

getseuserbyname(3) will return the GNU / Linux user name
as the SELinux user.

if set to 1:

getseuserbyname(3) will fail.

the getseuserbyname(3) man page should be consulted for its use. the format of the seusers file is shown in seusers(5). iykyk 📚

🌈 AUTORELABEL

this is an optional entry that allows the file system to be relabeled. the glow-up toggle, if you will ✨

• if set to 0 and there is a file called .autorelabel in the root directory, then on a reboot, the loader will drop to a shell where a root login is required. an administrator can then manually relabel the file system. very hands-on, very DIY 🛠️
• if set to 1 or no entry present (the default) and there is a .autorelabel file in the root directory, then the file system will be automatically relabeled using fixfiles -F restore. set it and forget it bestie 💖

in both cases the /.autorelabel file will be removed so that relabeling is not done again. one and done, we love a clean exit 🎀

---

⭐ EXAMPLE ⭐

this example config file shows the minimum contents for a system to run SELinux in enforcing mode, with a policy_name of 'targeted':

SELINUX = enforcing
SELINUXTYPE = targeted

look at that. two lines. minimum effort, maximum security. slay 👑

---

💜 SEE ALSO 💜

selinux(8), sestatus(8), selinux_path(3), selinux_policy_root_path(3), selinux_binary_policy_path(3), getseuserbyname(3), PAM(8), fixfiles(8), selinux_mkload_policy(3), selinux_getpolicytype(3), security_policyvers(3), selinux_getenforcemode(3), seusers(5)

go read those too, they're all part of the friend group 🫶

---

and that's the whole page bestie!! this one's from Security Enhanced Linux, dated 18 Nov 2011, and it lives at selinux_config(5) — mwah, take care of your config file and it'll take care of you 💅💖