SELinux (Security-Enhanced Linux) is a security layer on RHEL-family systems that enforces strict rules about what each process can access. It’s valuable, but it sometimes blocks legitimate software and causes “permission denied” errors that aren’t obvious. This guide shows how to check SELinux status and disable it – temporarily or permanently – on CentOS, RHEL, AlmaLinux, Rocky Linux, and Fedora.
Check the Current SELinux Status
First, see what mode SELinux is in:
sestatus # or, for just the current mode: getenforce
You’ll see one of three states: Enforcing (rules are applied), Permissive (rules are logged but not applied), or Disabled (SELinux is off).
Disable SELinux Temporarily (Until Reboot)
To switch SELinux to permissive mode immediately, without a reboot:
sudo setenforce 0 # confirm: getenforce # should return: Permissive
This is the recommended first step for troubleshooting – it reverts to enforcing on the next reboot, so you can’t lock yourself out permanently. Use sudo setenforce 1 to turn enforcing back on.
Disable SELinux Permanently
To change the mode across reboots, edit the SELinux config file:
sudo nano /etc/selinux/config
Find the SELINUX line and set it to permissive (recommended) or disabled:
# for permissive (safer): SELINUX=permissive # or to fully disable: SELINUX=disabled
Save the file and reboot for the change to take effect:
sudo reboot
Verify After Reboot
getenforce # returns Permissive or Disabled, matching your config
FAQ
Q: How do I check if SELinux is enabled? – Run sestatus or getenforce. The output shows Enforcing, Permissive, or Disabled.
Q: Should I disable SELinux or set it to permissive? – Permissive is usually the better choice: it keeps SELinux active and logs what it would block, so you can fix issues without losing the security layer. Disable it fully only when necessary.
Q: How do I disable SELinux without rebooting? – Run sudo setenforce 0 to switch to permissive mode immediately. This reverts on reboot; to make it permanent, edit /etc/selinux/config.