1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
.TH "selinux_config" "5" "18 Nov 2011" "Security Enhanced Linux" "SELinux configuration file"
.SH "NAME"
config \- The SELinux sub-system configuration file.
.SH "DESCRIPTION"
The SELinux \fIconfig\fR file controls the state of SELinux regarding:
.RS
.IP "1." 4
The policy enforcement status \- \fIenforcing\fR, \fIpermissive\fR or \fIdisabled\fR.
.IP "2." 4
The policy name or type that forms a path to the policy to be loaded and its supporting configuration files.
.IP "3." 4
How local users and booleans will be managed when the policy is loaded (note that this function was used by older releases of SELinux and is now deprecated).
.IP "4." 4
How SELinux-aware login applications should behave if no valid SELinux users are configured.
.IP "5." 4
Whether the system is to be relabeled or not.
.RE
The entries controlling these functions are described in the \fBFILE FORMAT\fR section.
.sp
The fully qualified path name of the SELinux configuration file is \fI/etc/selinux/config\fR.
.sp
If the \fIconfig\fR file is missing or corrupt, then no SELinux policy is loaded (i.e. SELinux is disabled).
.sp
The \fBsestatus\fR (8) command and the libselinux function \fBselinux_path\fR (3) will return the location of the \fIconfig\fR file.
.SH "FILE FORMAT"
The \fIconfig\fR file supports the following parameters:
.sp
.RS
\fBSELINUX = \fIenforcing\fR | \fIpermissive\fR | \fIdisabled\fR
.br
\fBSELINUXTYPE = \fIpolicy_name\fR
.br
\fBSETLOCALDEFS = \fI0\fR | \fI1\fR
.br
\fBREQUIREUSERS = \fI0\fR | \fI1\fR
.br
\fBAUTORELABEL = \fI0\fR | \fI1\fR
.RE
.sp
Where:
.br
.B SELINUX
.RS
This entry can contain one of three values:
.RS
.IP \fIenforcing\fR 4
SELinux security policy is enforced.
.IP \fIpermissive\fR 4
SELinux security policy is not enforced but logs the warnings (i.e. the action is allowed to proceed).
.IP \fIdisabled\fR
SELinux is disabled and no policy is loaded.
.RE
.sp
The entry can be determined using the \fBsestatus\fR(8) command or \fBselinux_getenforcemode\fR(3).
.RE
.sp
.B SELINUXTYPE
.RS
The \fIpolicy_name\fR entry is used to identify the policy type, and becomes the directory name of where the policy and its configuration files are located.
.sp
The entry can be determined using the \fBsestatus\fR(8) command or \fBselinux_getpolicytype\fR(3).
.sp
The \fIpolicy_name\fR is relative to a path that is defined within the SELinux subsystem that can be retrieved by using \fBselinux_path\fR(3). An example entry retrieved by \fBselinux_path\fR(3) is:
.br
.RS
.I /etc/selinux/
.RE
.sp
The \fIpolicy_name\fR is then appended to this and becomes the 'policy root' location that can be retrieved by \fBselinux_policy_root_path\fR(3). An example entry retrieved is:
.RS
.I /etc/selinux/targeted
.RE
.sp
The actual binary policy is located relative to this directory and also has a policy name pre-allocated. This information can be retrieved using \fBselinux_binary_policy_path\fR(3). An example entry retrieved by \fBselinux_binary_policy_path\fR(3) is:
.br
.RS
.I /etc/selinux/targeted/policy/policy
.RE
.sp
The binary policy name has by convention the SELinux policy version that it supports appended to it. The maximum policy version supported by the kernel can be determined using the \fBsestatus\fR(8) command or \fBsecurity_policyvers\fR(3). An example binary policy file with the version is:
.br
.RS
.I /etc/selinux/targeted/policy/policy.24
.RE
.RE
.sp
.B SETLOCALDEFS
.RS
This entry is deprecated and should be removed or set to \fI0\fR.
.sp
If set to \fI1\fR, then \fBselinux_mkload_policy\fR(3) will read the local customization for booleans (see \fBbooleans\fR(5)) and users (see \fBlocal.users\fR(5)).
.RE
.sp
.B REQUIRESEUSERS
.RS
This optional entry can be used to fail a login if there is no matching or default entry in the
.BR seusers "(5) file or if the " seusers " file is missing. "
.sp
It is checked by \fBgetseuserbyname\fR(3) that is called by SELinux-aware login applications such as \fBPAM\fR(8).
.sp
If set to \fI0\fR or the entry missing:
.RS
.BR getseuserbyname "(3) will return the GNU / Linux user name as the SELinux user."
.RE
.sp
If set to \fI1\fR:
.RS
.BR getseuserbyname "(3) will fail."
.RE
.sp
The \fBgetseuserbyname\fR(3) man page should be consulted for its use. The format of the \fIseusers\fR file is shown in \fBseusers\fR(5).
.sp
.RE
.sp
.B AUTORELABEL
.RS
This is an optional entry that allows the file system to be relabeled.
.sp
If set to \fI0\fR and there is a file called \fI.autorelabel\fR in the root directory, then on a reboot, the loader will drop to a shell where a root login is required. An administrator can then manually relabel the file system.
.sp
If set to \fI1\fR or no entry present (the default) and there is a \fI.autorelabel\fR file in the root directory, then the file system will be automatically relabeled using \fBfixfiles \-F restore\fR
.sp
In both cases the \fI/.autorelabel\fR file will be removed so that relabeling is not done again.
.RE
.sp
.SH "EXAMPLE"
This example \fIconfig\fR file shows the minimum contents for a system to run SELinux in enforcing mode, with a \fIpolicy_name\fR of 'targeted':
.sp
.RS
SELINUX = enforcing
.br
SELINUXTYPE = targeted
.RE
.SH "SEE ALSO"
.BR selinux "(8), " sestatus "(8), " selinux_path "(3), " selinux_policy_root_path "(3), " selinux_binary_policy_path "(3), " getseuserbyname "(3), " PAM "(8), " fixfiles "(8), " selinux_mkload_policy "(3), " selinux_getpolicytype "(3), " security_policyvers "(3), " selinux_getenforcemode "(3), " seusers "(5), " booleans "(5), " local.users "(5) "
|
