--- name: "selinux_config" section: "5" platform: "linux" package: "policycoreutils" version: "3.8.1-2" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/selinux_config" --- # selinux\_config(5) The SELinux sub-system configuration file. ## NAME config - The SELinux sub-system configuration file. ## DESCRIPTION The SELinux *config* file controls the state of SELinux regarding: - 1\. The policy enforcement status - *enforcing*, *permissive* or *disabled*. - 2\. The policy name or type that forms a path to the policy to be loaded and its supporting configuration files. - 3\. How SELinux-aware login applications should behave if no valid SELinux users are configured. - 4\. Whether the system is to be relabeled or not. The entries controlling these functions are described in the **FILE FORMAT** section. The fully qualified path name of the SELinux configuration file is */etc/selinux/config*. If the *config* file is missing or corrupt, then no SELinux policy is loaded (i.e. SELinux is disabled). The **sestatus** (8) command and the libselinux function **selinux\_path** (3) will return the location of the *config* file. ## FILE FORMAT The *config* file supports the following parameters: **SELINUX =** *enforcing* \| *permissive* \| *disabled*\ **SELINUXTYPE =** *policy\_name*\ **REQUIRESEUSERS =** *0* \| *1*\ **AUTORELABEL =** *0* \| *1* Where:\ **SELINUX** This entry can contain one of three values: - *enforcing* SELinux security policy is enforced. - *permissive* SELinux security policy is not enforced but logs the warnings (i.e. the action is allowed to proceed). - *disabled* No SELinux policy is loaded. This option was used to disable SELinux completely, which is now deprecated. Use the **selinux=0** kernel boot option instead (see [**selinux**(8)](/selinux/8.md)). The entry can be determined using the [**sestatus**(8)](/sestatus/8.md) command or [**selinux\_getenforcemode**(3)](/selinux_getenforcemode/3.md). **SELINUXTYPE** The *policy\_name* entry is used to identify the policy type, and becomes the directory name of where the policy and its configuration files are located. The entry can be determined using the [**sestatus**(8)](/sestatus/8.md) command or [**selinux\_getpolicytype**(3)](/selinux_getpolicytype/3.md). The *policy\_name* is relative to a path that is defined within the SELinux subsystem that can be retrieved by using [**selinux\_path**(3)](/selinux_path/3.md). An example entry retrieved by [**selinux\_path**(3)](/selinux_path/3.md) is:\ */etc/selinux/* The *policy\_name* is then appended to this and becomes the 'policy root' location that can be retrieved by **selinux\_policy\_root\_path**(3). An example entry retrieved is: */etc/selinux/targeted* The actual binary policy is located relative to this directory and also has a policy name pre-allocated. This information can be retrieved using [**selinux\_binary\_policy\_path**(3)](/selinux_binary_policy_path/3.md). An example entry retrieved by [**selinux\_binary\_policy\_path**(3)](/selinux_binary_policy_path/3.md) is:\ */etc/selinux/targeted/policy/policy* The binary policy name has by convention the SELinux policy version that it supports appended to it. The maximum policy version supported by the kernel can be determined using the [**sestatus**(8)](/sestatus/8.md) command or [**security\_policyvers**(3)](/security_policyvers/3.md). An example binary policy file with the version is:\ */etc/selinux/targeted/policy/policy.24* **REQUIRESEUSERS** This optional entry can be used to fail a login if there is no matching or default entry in the [**seusers**(5)](/seusers/5.md) file or if the **seusers** file is missing. It is checked by [**getseuserbyname**(3)](/getseuserbyname/3.md) that is called by SELinux-aware login applications such as [**PAM**(8)](/PAM/8.md). If set to *0* or the entry missing: [**getseuserbyname**(3)](/getseuserbyname/3.md) will return the GNU / Linux user name as the SELinux user. If set to *1*: [**getseuserbyname**(3)](/getseuserbyname/3.md) will fail. The [**getseuserbyname**(3)](/getseuserbyname/3.md) man page should be consulted for its use. The format of the *seusers* file is shown in [**seusers**(5)](/seusers/5.md). **AUTORELABEL** This is an optional entry that allows the file system to be relabeled. If set to *0* and there is a file called *.autorelabel* in the root directory, then on a reboot, the loader will drop to a shell where a root login is required. An administrator can then manually relabel the file system. If set to *1* or no entry present (the default) and there is a *.autorelabel* file in the root directory, then the file system will be automatically relabeled using **fixfiles -F restore** In both cases the */.autorelabel* file will be removed so that relabeling is not done again. ## EXAMPLE This example *config* file shows the minimum contents for a system to run SELinux in enforcing mode, with a *policy\_name* of 'targeted': SELINUX = enforcing\ SELINUXTYPE = targeted ## SEE ALSO [**selinux**(8)](/selinux/8.md), [**sestatus**(8)](/sestatus/8.md), [**selinux\_path**(3)](/selinux_path/3.md), **selinux\_policy\_root\_path**(3), [**selinux\_binary\_policy\_path**(3)](/selinux_binary_policy_path/3.md), [**getseuserbyname**(3)](/getseuserbyname/3.md), [**PAM**(8)](/PAM/8.md), [**fixfiles**(8)](/fixfiles/8.md), [**selinux\_mkload\_policy**(3)](/selinux_mkload_policy/3.md), [**selinux\_getpolicytype**(3)](/selinux_getpolicytype/3.md), [**security\_policyvers**(3)](/security_policyvers/3.md), [**selinux\_getenforcemode**(3)](/selinux_getenforcemode/3.md), [**seusers**(5)](/seusers/5.md)