1 What: /sys/fs/selinux/disable 1 What: /sys/fs/selinux/disable
2 Date: April 2005 (predates git) 2 Date: April 2005 (predates git)
3 KernelVersion: 2.6.12-rc2 (predates git) 3 KernelVersion: 2.6.12-rc2 (predates git)
4 Contact: selinux@vger.kernel.org 4 Contact: selinux@vger.kernel.org
5 Description: 5 Description:
6 6
7 REMOVAL UPDATE: The SELinux runtime di 7 REMOVAL UPDATE: The SELinux runtime disable functionality was removed
8 in March 2023, the original deprecatio 8 in March 2023, the original deprecation notice is shown below.
9 9
10 The selinuxfs "disable" node allows SE 10 The selinuxfs "disable" node allows SELinux to be disabled at runtime
11 prior to a policy being loaded into th 11 prior to a policy being loaded into the kernel. If disabled via this
12 mechanism, SELinux will remain disable 12 mechanism, SELinux will remain disabled until the system is rebooted.
13 13
14 The preferred method of disabling SELi 14 The preferred method of disabling SELinux is via the "selinux=0" boot
15 parameter, but the selinuxfs "disable" 15 parameter, but the selinuxfs "disable" node was created to make it
16 easier for systems with primitive boot 16 easier for systems with primitive bootloaders that did not allow for
17 easy modification of the kernel comman 17 easy modification of the kernel command line. Unfortunately, allowing
18 for SELinux to be disabled at runtime 18 for SELinux to be disabled at runtime makes it difficult to secure the
19 kernel's LSM hooks using the "__ro_aft 19 kernel's LSM hooks using the "__ro_after_init" feature.
20 20
21 Thankfully, the need for the SELinux r 21 Thankfully, the need for the SELinux runtime disable appears to be
22 gone, the default Kconfig configuratio 22 gone, the default Kconfig configuration disables this selinuxfs node,
23 and only one of the major distribution 23 and only one of the major distributions, Fedora, supports disabling
24 SELinux at runtime. Fedora is in the 24 SELinux at runtime. Fedora is in the process of removing the
25 selinuxfs "disable" node and once that 25 selinuxfs "disable" node and once that is complete we will start the
26 slow process of removing this code fro 26 slow process of removing this code from the kernel.
27 27
28 More information on /sys/fs/selinux/di 28 More information on /sys/fs/selinux/disable can be found under the
29 CONFIG_SECURITY_SELINUX_DISABLE Kconfi 29 CONFIG_SECURITY_SELINUX_DISABLE Kconfig option.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.