30 lines · plain
1What: /sys/fs/selinux/disable2Date: April 2005 (predates git)3KernelVersion: 2.6.12-rc2 (predates git)4Contact: selinux@vger.kernel.org5Description:6 7 REMOVAL UPDATE: The SELinux runtime disable functionality was removed8 in March 2023, the original deprecation notice is shown below.9 10 The selinuxfs "disable" node allows SELinux to be disabled at runtime11 prior to a policy being loaded into the kernel. If disabled via this12 mechanism, SELinux will remain disabled until the system is rebooted.13 14 The preferred method of disabling SELinux is via the "selinux=0" boot15 parameter, but the selinuxfs "disable" node was created to make it16 easier for systems with primitive bootloaders that did not allow for17 easy modification of the kernel command line. Unfortunately, allowing18 for SELinux to be disabled at runtime makes it difficult to secure the19 kernel's LSM hooks using the "__ro_after_init" feature.20 21 Thankfully, the need for the SELinux runtime disable appears to be22 gone, the default Kconfig configuration disables this selinuxfs node,23 and only one of the major distributions, Fedora, supports disabling24 SELinux at runtime. Fedora is in the process of removing the25 selinuxfs "disable" node and once that is complete we will start the26 slow process of removing this code from the kernel.27 28 More information on /sys/fs/selinux/disable can be found under the29 CONFIG_SECURITY_SELINUX_DISABLE Kconfig option.30