SELinux permissive mode
Topics: SELinux
SELinux permissive mode records policy denials without blocking operations.
Subtopics
When to use it
On a private, disposable development host, permissive mode removes SELinux enforcement while keeping its audit logging. It is useful when the policy creates more friction than protection, such as a host used for arbitrary SSH port forwarding and local development services.
Do not use it on production or shared systems.
Enable permissive mode
sudo setenforce 0
sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
getenforce
setenforce 0 applies until the next reboot. The configuration change makes the setting persistent. getenforce should report Permissive.
Prefer permissive to disabled
Do not set SELINUX=disabled. Disabled mode removes audit visibility and takes more disruptive configuration changes to restore. Permissive mode keeps the policy and continues to record denials, but does not block operations.