On CentOS 7, SELinux can be disabled persistently through /etc/selinux/config, followed by a reboot. Disabling it removes an access-control layer and should not be the default response to an application permission problem. If you are diagnosing a denial, investigate it first and consider a controlled permissive-mode test instead.
Historical system: CentOS Linux 7 reached end of life on June 30, 2024, as documented by the CentOS Project. This article is for an existing legacy installation. A SELinux change does not restore operating-system support; plan migration to a supported environment.
Check the current state
On the host you administer, these commands report the current mode and policy information:
getenforce
sestatusSELinux has enforcing, permissive and disabled states. Enforcing applies the policy; permissive records policy violations without enforcing them; disabled does not load the SELinux policy. targeted is a policy name, not a fourth mode. See Red Hat's RHEL 7 SELinux states and modes.
Investigate a denial before weakening enforcement
Identify the failing operation and its matching audit entry. Incorrect file labels or an appropriate policy setting can be the cause; a generic application error is not proof that SELinux is responsible. Red Hat's SELinux troubleshooting guidance explains the diagnostic approach.
If the system owner approves a temporary host-wide diagnostic change, an administrator can run sudo setenforce 0 while SELinux is enabled. Reproduce the specific operation, review the evidence and restore enforcement with sudo setenforce 1. This changes the running mode, not the persistent configuration. It does not turn a disabled system back on.
If disabling is an explicit legacy requirement
- Agree the security exception, maintenance window and recovery plan with the system owner. Confirm console access and a recoverable backup.
- Save a copy of
/etc/selinux/configbefore editing it. - Set the existing mode assignment to
SELINUX=disabled, preserving the uppercase variable name. Do not confuse it withSELINUXTYPE=targeted. - Reboot during the agreed window. Verify the resulting mode with
getenforceand check the application.
For the persistent configuration procedure, consult Red Hat's changing SELinux modes documentation.
Do not improvise the return to enforcing mode
Files created while SELinux is disabled may lack the required labels. Re-enabling it can therefore require relabeling and a staged return through permissive mode. Follow the vendor procedure and allow for downtime; changing the configuration straight back to enforcing is not a complete recovery plan.
Record why the exception was needed and who owns removing it. Correct the application or policy issue where possible, and treat replacement of the unsupported CentOS 7 installation as separate work.
