162306a36Sopenharmony_ciWhat: /sys/fs/selinux/disable 262306a36Sopenharmony_ciDate: April 2005 (predates git) 362306a36Sopenharmony_ciKernelVersion: 2.6.12-rc2 (predates git) 462306a36Sopenharmony_ciContact: selinux@vger.kernel.org 562306a36Sopenharmony_ciDescription: 662306a36Sopenharmony_ci 762306a36Sopenharmony_ci REMOVAL UPDATE: The SELinux runtime disable functionality was removed 862306a36Sopenharmony_ci in March 2023, the original deprecation notice is shown below. 962306a36Sopenharmony_ci 1062306a36Sopenharmony_ci The selinuxfs "disable" node allows SELinux to be disabled at runtime 1162306a36Sopenharmony_ci prior to a policy being loaded into the kernel. If disabled via this 1262306a36Sopenharmony_ci mechanism, SELinux will remain disabled until the system is rebooted. 1362306a36Sopenharmony_ci 1462306a36Sopenharmony_ci The preferred method of disabling SELinux is via the "selinux=0" boot 1562306a36Sopenharmony_ci parameter, but the selinuxfs "disable" node was created to make it 1662306a36Sopenharmony_ci easier for systems with primitive bootloaders that did not allow for 1762306a36Sopenharmony_ci easy modification of the kernel command line. Unfortunately, allowing 1862306a36Sopenharmony_ci for SELinux to be disabled at runtime makes it difficult to secure the 1962306a36Sopenharmony_ci kernel's LSM hooks using the "__ro_after_init" feature. 2062306a36Sopenharmony_ci 2162306a36Sopenharmony_ci Thankfully, the need for the SELinux runtime disable appears to be 2262306a36Sopenharmony_ci gone, the default Kconfig configuration disables this selinuxfs node, 2362306a36Sopenharmony_ci and only one of the major distributions, Fedora, supports disabling 2462306a36Sopenharmony_ci SELinux at runtime. Fedora is in the process of removing the 2562306a36Sopenharmony_ci selinuxfs "disable" node and once that is complete we will start the 2662306a36Sopenharmony_ci slow process of removing this code from the kernel. 2762306a36Sopenharmony_ci 2862306a36Sopenharmony_ci More information on /sys/fs/selinux/disable can be found under the 2962306a36Sopenharmony_ci CONFIG_SECURITY_SELINUX_DISABLE Kconfig option. 30