How do I disable selinux on F18?

[tokyojoe]

SELinux is crap, all the problem I had on my new install of Fedora 18 (chrome crashing, plugins problems, samba) were caused by it, as for the security of a desktop computer it is irrelevant, all the companies I work for even the ones with sensitive information and a large base of RHEL server had SELinux disabled.

As for the settings that's quite confusing after a few problems I tried to disable it by modifying the /etc/sysconfig/selinux file,
then another problem came along and after a few hour I realized it came do to SELinux being still enabled.

On my system there is two different file and I guess one is not taken
into account, I think it would be better to disable SELinux in the next release.
I guess the relevant one is /etc/selinux/config

$ lsb_release -a
LSB Version:	:core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch
Distributor ID:	Fedora
Description:	Fedora release 18 (Spherical Cow)
Release:	18
Codename:	SphericalCow

$ rpm -qf /etc/sysconfig/selinux /etc/selinux/config
selinux-policy-3.11.1-73.fc18.noarch
selinux-policy-3.11.1-73.fc18.noarch

$ ls -i  /etc/sysconfig/selinux /etc/selinux/config
1050081 /etc/selinux/config  1054054 /etc/sysconfig/selinux

$ grep SELINUX= /etc/sysconfig/selinux /etc/selinux/config
/etc/sysconfig/selinux:SELINUX=disabled
/etc/selinux/config:SELINUX=enforcing

Sorry, I realize now that I brought back a very old thread, but that's the one that came back when I searched on howto disable SELinux.

[bob]

Moved to it's own thread. Don't try to add to a dead one, just start a new thread. I suppose you're asking a question, right? Need to disable SELinux? Maybe make it Permissive instead?

Frankly, I haven't had a problem with F17 or F18 leaving it intact, but if it solves your problem, then let's have someone give you a quick fix. http://forums.fedoraforum.org/showthread.php?t=281664

[smr54]

To permanently disable it, edit /etc/sysconfig/selinux and change enabled to disabled. This requires a reboot.

If you think there's any chance you might want to work with it in the future, you can also change it to permissive. This means that it will give warnings but won't block anything.

For better or worse, it's going to continue to be included, but it's very easy to disable.

[nonamedotc]

As smr54 has mentioned above, you can easily set it to permissive/disabled. To set it to permissive, try

 setenforce 0

as an alternative to editing configuration file.

[domg472]

security of a desktop computer it is irrelevant

This is why we can't have nice things

[FergatROn]

This is why we can't have nice things

Ha-ha, excellent quote.

[tokyojoe]

To permanently disable it, edit /etc/sysconfig/selinux and change enabled to disabled. This requires a reboot.

Actually the one you need to modify is /etc/selinux/config,
if you set SELINUX to disabled in /etc/sysconfig/selinux and reboot, SELinux will still be enabled.

Both file have different inode and are part of the selinux-policy package,
don't know if there is a reason for that but that's quite confusing.

[~]$ sudo ls -li  /etc/sysconfig/selinux /etc/selinux/config 
1054076 -rw-r--r--. 1 root root 546 Feb  8 09:21 /etc/selinux/config
1054054 -rw-r--r--. 1 root root 499 Feb  7 18:39 /etc/sysconfig/selinux
[~]$ grep ^SELINUX= /etc/sysconfig/selinux /etc/selinux/config
/etc/sysconfig/selinux:SELINUX=disabled
/etc/selinux/config:SELINUX=disabled

[~]$ rpm -qf /etc/sysconfig/selinux /etc/selinux/config
selinux-policy-3.11.1-74.fc18.noarch
selinux-policy-3.11.1-74.fc18.noarch

[domg472]

Chances are one has been abusing sed which could have caused that file to be created and caused to link to be overwritten.

/etc/sysconfig/selinux should be no file at all. Instead it should be a symbolic link to /etc/selinux/config

This is fine in a fresh installed system, so likely a boo boo by the user...

[tokyojoe]

/etc/sysconfig/selinux should be no file at all. Instead it should be a symbolic link to /etc/selinux/config
.

That's right I did edit that file with sed, I did not know that it would remove the symlink,
I have corrected it now, thanks for checking that !

[hbaird]

I tried changeing both files to disable and the boot stopped at the Fedora Icon. I went to CTRL?ALT F1 logged in as root and put it them back to permissive. I rebooted and am back to normal. Is this normal?

[scottknight]

I tried changeing both files to disable and the boot stopped at the Fedora Icon. I went to CTRL?ALT F1 logged in as root and put it them back to permissive. I rebooted and am back to normal. Is this normal?

If your system is running properly, then permissive==normal until you can work out the problem. I learned to always run my systems in permissive mode to work out any issues. You can see any selinux problems with dmesg while in permissive mode (probably in enforcing as well). Don't be afraid to try setroubleshooter.

[hbaird]

Thank you for the reply I will go with permisive for now.
Harold

[rhatdan]

There should only be one file /etc/sysconfig/selinux is supposed to be a symlink to /etc/selinux/config

[tokyojoe]

Today I got an error when I moved a file, even though SELinux is disabled:

mv: setting attribute ‘security.selinux’ for ‘security.selinux’: Operation not permitted