Disable SELinux in Linux (Runtime, Permissive, and Permanent)

SELinux adds Mandatory Access Control on top of normal file permissions. Most RHEL-family systems stay in Enforcing mode. When a service misbehaves, operators search for how to disable SELinux—but the safer path is usually permissive (whole system or one domain) while you read AVC logs and fix labels or booleans.

On RHEL 9 and 10, fully disabling SELinux is a kernel command-line change (selinux=0 through grubby). Setting SELINUX=disabled in /etc/selinux/config alone is not the current method for fully disabling SELinux; use the selinux=0 kernel argument instead.

Quick answer

setenforce cannot move the system to Disabled. For label repair, booleans, and restorecon, see SELinux modes and file contexts.

Check the current SELinux mode

Before you change anything, read the active mode and what /etc/selinux/config will apply on the next boot when selinux=0 is not present.

getenforce

Sample output:

Enforcing

Add detail with sestatus:

sestatus

Sample output:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing

Compare Current mode with Mode from config file. If they differ, a prior setenforce or a GRUB/grubby kernel argument changed runtime state.

Read the kernel enforce switch when SELinux is loaded:

cat /sys/fs/selinux/enforce

Sample output when enforcing:

1

A value of 0 means permissive. The pseudo-file is absent when SELinux is disabled.

Check whether selinux=0 is already on the default kernel entry:

grubby --info=DEFAULT | grep ^args=

Sample output on vm1.lab.example:

args="ro resume=UUID=78531da6-a389-46e8-9bad-267572940826 rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet crashkernel=2G-64G:256M,64G-:512M $tuned_params"

When selinux=0 is present in that line, the next boot disables SELinux regardless of SELINUX= in /etc/selinux/config.

The config file still controls enforcing versus permissive when SELinux is enabled:

grep '^SELINUX=' /etc/selinux/config

Sample output:

SELINUX=enforcing

Temporarily disable enforcement with setenforce

Use setenforce when you have shell access and need Permissive or Enforcing until the next reboot. This does not disable SELinux.

Move to permissive mode:

sudo setenforce 0

Verify the change:

getenforce

Sample output:

Permissive

The kernel switch should read 0:

cat /sys/fs/selinux/enforce

Sample output:

0

Restore enforcing mode when you finish troubleshooting:

sudo setenforce 1

Confirm enforcement is back:

getenforce

Sample output:

Enforcing

Permissive still loads policy and keeps labels; it only stops blocking denials. That is why Red Hat recommends it over selinux=0 for diagnosis.

Make one SELinux domain permissive

When a single daemon (for example httpd) triggers denials, mark only its domain permissive while the rest of the system stays enforcing.

Install the Python utils package if semanage is missing (dnf install policycoreutils-python-utils on RHEL-family systems).

Add permissive mode for the Apache domain:

sudo semanage permissive -a httpd_t

The command exits silently when it succeeds. List customized permissive domains:

sudo semanage permissive -l

Sample output:

Customized Permissive Types

httpd_t

You can also confirm the module name:

semodule -l | grep permissive_httpd

Sample output:

permissive_httpd_t

With httpd_t permissive, Apache behaves as if SELinux were off for that domain while SSH, databases, and other domains remain enforcing.

Remove the override when policy is fixed:

sudo semanage permissive -d httpd_t

Sample output:

libsemanage.semanage_direct_remove_key: Removing last permissive_httpd_t module (no other permissive_httpd_t module exists at another priority).

Replace httpd_t with the domain from ps -eZ or AVC logs for your service. Port and boolean fixes belong in SELinux ports and booleans.

Disable SELinux completely with selinux=0

On RHEL 9 and later, Red Hat documents full disable through the selinux=0 kernel parameter. I did not leave vm1.lab.example disabled after writing this guide; the steps below match current Red Hat documentation.

Add selinux=0 to every installed kernel:

sudo grubby --update-kernel ALL --args selinux=0

Reboot to apply:

sudo reboot

After reboot, confirm the mode:

getenforce

Sample output:

Disabled

Verify the argument is on the default kernel:

grubby --info=DEFAULT | grep selinux

You should see selinux=0 in the args= line.

To boot in permissive on every boot while keeping SELinux loaded, use enforcing=0 instead of selinux=0:

sudo grubby --update-kernel ALL --args enforcing=0

Remove a persistent kernel argument when you no longer need it:

sudo grubby --update-kernel ALL --remove-args selinux=0

Disable SELinux for one boot from GRUB

Use the GRUB editor when you cannot run grubby yet—for example the system will not boot cleanly with enforcing policy.

Steps:

1. Reboot and stop at the GRUB menu before the timer expires.
2. Highlight the default entry and press e to edit.
3. Move to the line starting with linux or linuxefi.
4. Append enforcing=0 (permissive) or selinux=0 (disabled) to the end of that line.
5. Press Ctrl+x to boot with the edited entry.

That change applies to one boot only. For a persistent change on RHEL 9+, use grubby in the previous section.

Re-enable SELinux after it was disabled

Do not jump straight from Disabled to Enforcing when labels may be missing. Red Hat schedules relabeling with fixfiles -F onboot and expects the relabel boot to run in permissive mode so unlabeled objects do not block startup.

Remove the disable kernel argument from all kernels:

sudo grubby --update-kernel ALL --remove-args selinux=0

Add enforcing=0 so the next boots stay permissive even if /etc/selinux/config still lists enforcing:

sudo grubby --update-kernel ALL --args enforcing=0

Set permissive in the config file:

# /etc/selinux/config
SELINUX=permissive
SELINUXTYPE=targeted

Schedule a full relabel on the next boot:

sudo fixfiles -F onboot

Reboot and let the relabel run while the system stays permissive:

sudo reboot

After reboot, confirm permissive mode:

getenforce

Sample output:

Permissive

When services behave correctly and relabeling finished, remove the permissive kernel override:

sudo grubby --update-kernel ALL --remove-args enforcing=0

Move to enforcing in the config file:

SELINUX=enforcing

Reboot into enforcing mode:

sudo reboot

Confirm enforcement:

getenforce

Sample output:

Enforcing

Troubleshooting

References

• Red Hat Enterprise Linux 10 — Using SELinux
• Changing SELinux states and modes — Red Hat documentation
• SELinux Project wiki

Summary

SELinux on Linux supports Enforcing, Permissive, and Disabled. For short troubleshooting, setenforce 0 moves the running system to permissive without a reboot, and setenforce 1 puts enforcement back. That is the lightest-touch change when you still want policy and labels loaded.

When one daemon is the problem, semanage permissive -a domain_t keeps the rest of the host enforcing—a better default than turning SELinux off system-wide. On RHEL 9 and 10, fully disabling SELinux means grubby --update-kernel ALL --args selinux=0 followed by a reboot. Setting SELINUX=disabled in /etc/selinux/config alone is not the current method for fully disabling SELinux; use the selinux=0 kernel argument instead.

Use a one-time GRUB append (enforcing=0 or selinux=0) when the system will not boot cleanly. To turn SELinux back on, remove selinux=0, add enforcing=0 with grubby, set permissive in the config file, run fixfiles -F onboot, and reboot so relabeling completes in permissive mode. After verification, remove enforcing=0, set enforcing, and reboot again.