selinux_config(5)					    SELinux configuration file						 selinux_config(5)

NAME

       config - The SELinux sub-system configuration file.

DESCRIPTION

       The SELinux config file controls the state of SELinux regarding:

	      1.  The policy enforcement status - enforcing, permissive or disabled.

	      2.  The policy name or type that forms a path to the policy to be loaded and its supporting configuration files.

	      3.  How  local  users  and booleans will be managed when the policy is loaded (note that this function was used by older releases of
		  SELinux and is now deprecated).

	      4.  How SELinux-aware login applications should behave if no valid SELinux users are configured.

	      5.  Whether the system is to be relabeled or not.

       The entries controlling these functions are described in the FILE FORMAT section.

       The fully qualified path name of the SELinux configuration file is /etc/selinux/config.

       If the config file is missing or corrupt, then no SELinux policy is loaded (i.e. SELinux is disabled).

       The sestatus (8) command and the libselinux function selinux_path (3) will return the location of the config file.

FILE FORMAT

       The config file supports the following parameters:

	      SELINUX = enforcing | permissive | disabled
	      SELINUXTYPE = policy_name
	      SETLOCALDEFS = 0 | 1
	      REQUIREUSERS = 0 | 1
	      AUTORELABEL = 0 | 1

       Where:
       SELINUX
	      This entry can contain one of three values:

		     enforcing
			 SELinux security policy is enforced.

		     permissive
			 SELinux security policy is not enforced but logs the warnings (i.e. the action is allowed to proceed).

		     disabled
			 SELinux is disabled and no policy is loaded.

	      The entry can be determined using the sestatus(8) command or selinux_getenforcemode(3).

       SELINUXTYPE
	      The policy_name entry is used to identify the policy type, and becomes the directory name of where the policy and its  configuration
	      files are located.

	      The entry can be determined using the sestatus(8) command or selinux_getpolicytype(3).

	      The  policy_name	is relative to a path that is defined within the SELinux subsystem that can be retrieved by using selinux_path(3).
	      An example entry retrieved by selinux_path(3) is:
		     /etc/selinux/

	      The policy_name is then  appended  to  this  and	becomes  the  'policy  root'  location	that  can  be  retrieved  by  selinux_pol-
	      icy_root_path(3). An example entry retrieved is:
		     /etc/selinux/targeted

	      The  actual  binary  policy  is located relative to this directory and also has a policy name pre-allocated. This information can be
	      retrieved using selinux_binary_policy_path(3). An example entry retrieved by selinux_binary_policy_path(3) is:
		     /etc/selinux/targeted/policy/policy

	      The binary policy name has by convention the SELinux policy version that it supports appended to it. The maximum policy version sup-
	      ported  by  the kernel can be determined using the sestatus(8) command or security_policyvers(3). An example binary policy file with
	      the version is:
		     /etc/selinux/targeted/policy/policy.24

       SETLOCALDEFS
	      This entry is deprecated and should be removed or set to 0.

	      If set to 1, then selinux_mkload_policy(3) will read  the  local	customisation  for  booleans  (see  booleans(5))  and  users  (see
	      local.users(5)).

       REQUIRESEUSERS
	      This  optional  entry  can be used to fail a login if there is no matching or default entry in the seusers(5) file or if the seusers
	      file is missing.

	      It is checked by getseuserbyname(3) that is called by SELinux-aware login applications such as PAM(8).

	      If set to 0 or the entry missing:
		     getseuserbyname(3) will return the GNU / Linux user name as the SELinux user.

	      If set to 1:
		     getseuserbyname(3) will fail.

	      The getseuserbyname(3) man page should be consulted for its use. The format of the seusers file is shown in seusers(5).

       AUTORELABEL
	      This is an optional entry that allows the file system to be relabeled.

	      If set to 0 and there is a file called .autorelabel in the root directory, then on a reboot, the loader will drop to a shell where a
	      root login is required. An administrator can then manually relabel the file system.

	      If  set  to 1 or no entry present (the default) and there is a .autorelabel file in the root directory, then the file system will be
	      automatically relabeled using fixfiles -F restore

	      In both cases the /.autorelabel file will be removed so that relabeling is not done again.

EXAMPLE

       This example config file shows the minimum contents for a system to run SELinux in enforcing mode, with a policy_name of 'targeted':

	      SELINUX = enforcing
	      SELINUXTYPE = targeted

SEE ALSO

       selinux(8), sestatus(8), selinux_path(3),  selinux_policy_root_path(3),	selinux_binary_policy_path(3),	getseuserbyname(3),  PAM(8),  fix-
       files(8),  selinux_mkload_policy(3),  selinux_getpolicytype(3), security_policyvers(3), selinux_getenforcemode(3), seusers(5), booleans(5),
       local.users(5)

Security Enhanced Linux 					    18 Nov 2011 						 selinux_config(5)