sysfs-selinux-disable (1289B)
1What: /sys/fs/selinux/disable 2Date: April 2005 (predates git) 3KernelVersion: 2.6.12-rc2 (predates git) 4Contact: selinux@vger.kernel.org 5Description: 6 7 The selinuxfs "disable" node allows SELinux to be disabled at runtime 8 prior to a policy being loaded into the kernel. If disabled via this 9 mechanism, SELinux will remain disabled until the system is rebooted. 10 11 The preferred method of disabling SELinux is via the "selinux=0" boot 12 parameter, but the selinuxfs "disable" node was created to make it 13 easier for systems with primitive bootloaders that did not allow for 14 easy modification of the kernel command line. Unfortunately, allowing 15 for SELinux to be disabled at runtime makes it difficult to secure the 16 kernel's LSM hooks using the "__ro_after_init" feature. 17 18 Thankfully, the need for the SELinux runtime disable appears to be 19 gone, the default Kconfig configuration disables this selinuxfs node, 20 and only one of the major distributions, Fedora, supports disabling 21 SELinux at runtime. Fedora is in the process of removing the 22 selinuxfs "disable" node and once that is complete we will start the 23 slow process of removing this code from the kernel. 24 25 More information on /sys/fs/selinux/disable can be found under the 26 CONFIG_SECURITY_SELINUX_DISABLE Kconfig option.