How to configure SELinux in permissive mode on CentOS Stream 9

Set SELinux to permissive mode on CentOS Stream 9 to allow applications to run without blocking operations while still logging violations. These steps target CentOS Stream 9 with the default SELinux policy and require root privileges. You will modify the runtime state and the persistent configuration file.

Prerequisites

• CentOS Stream 9 installed with SELinux enabled.
• Root access via su or sudo.
• A terminal or SSH session with a text editor like vi or nano.

Step 1: Check the current SELinux status

Confirm the current mode before making changes. This ensures you understand the starting state and validates that SELinux is active.

getenforce

You will see Enforcing if the system is blocking actions. If the output is Permissive, you are already in the target mode.

Enforcing

Step 2: Switch SELinux to permissive mode temporarily

Apply the change immediately to the running system. This allows you to test services without rebooting. The setting resets after a restart, so you must also edit the configuration file in the next step.

setenforce 0

The command returns no output on success. Run getenforce again to confirm the change.

Permissive

Step 3: Edit the SELinux configuration file

Make the permissive setting persistent across reboots. Open the main configuration file using your preferred text editor.

vi /etc/selinux/config

Locate the line starting with SELINUX=. Change the value from enforcing to permissive. Save and exit the editor.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive

Do not comment out the line. Keep the assignment active so the system reads the correct mode on boot.

Step 4: Verify the configuration file change

Reload the configuration without rebooting to apply the new setting immediately. This ensures the system uses the file setting right away.

setenforce 0

Then check the status again to confirm the file change took effect.

getenforce

Expected output:

Permissive

Step 5: Reboot the system (optional but recommended)

Reboot to ensure the kernel loads the permissive policy from the configuration file. This step is critical if you want the setting to survive a restart.

reboot

After the system boots, run the verification command again.

getenforce

Expected output:

Permissive

Verify the installation

Run the following command to confirm the system is in permissive mode and that the setting is persistent.

getenforce

Expected output:

Permissive

Also check the SELinux status details to ensure no errors are present.

sestatus

Look for SELinux status: enabled and Current mode: permissive in the output.

Troubleshooting

If setenforce 0 fails, check for typos in the command. Ensure you are running it as root.

bash: setenforce: command not found

This error indicates SELinux is not installed or not loaded. Reinstall the policy package:

dnf install policycoreutils-python

If the configuration file change is ignored, verify the file syntax. A missing newline at the end of the file can cause issues.

SELINUX=permissive

Add a newline at the end of the file if missing. Also ensure no other lines override the setting in /etc/selinux/config.

If the system reverts to Enforcing after reboot, check for SELINUX=disabled in /etc/selinux/config. Ensure the value is exactly permissive with no extra spaces.

If you need to restore the enforcing mode, run setenforce 1 and set SELINUX=enforcing in the config file.