Enabling SELinux for AlmaLinux and Rocky Linux 9.0

Scenarios

SELinux is a mandatory access control security module built in the Linux kernel. It effectively restricts process permissions and prevents privilege escalation attacks. In production environments, enabling SELinux is an important method to improve system security.

This section uses AlmaLinux 9.0 and RockyLinux 9.0 images as examples to describe how to enable SELinux. For other Linux distributions, see How Can I Enable SELinux on an ECS Running CentOS?

Prerequisites

The nux-policy-targeted, libselinux-utils, and policycoreutils software packages have been installed in your system.

You can run the following commands to check the installed versions:

rpm -qa |grep selinux-policy-targeted
rpm -qa |grep libselinux-utils
rpm -qa |grep policycoreutils

Procedure

Before performing operations in this section, you are advised to create a snapshot for the EVS disks attached to the ECS to prevent data loss caused by misoperations. For details, see Creating an EVS Snapshot.

Snapshots will generate additional costs. For details, see Billing for EVS Snapshots.

1. Check whether SELinux is enabled in the kernel.

   cat /boot/grub2/grub.cfg |grep selinux

   If selinux=0 or enforcing=0 is displayed, SELinux is disabled.

   

2. Modify the configuration file.

   sudo sed -i 's/SELINUX=disabled/SELINUX=enforcing/g' /etc/selinux/config; 
   cat /etc/selinux/config |grep -v "#" |grep -v "^$";

   

3. Remove the SELinux configuration from the kernel.

   grubby --update-kernel ALL --remove-args selinux

4. Re-label the system.

   touch /.autorelabel

5. Restart the ECS.

   reboot -f

6. Check whether SELinux is enabled.

   getenforce

   If the following information is displayed, SELinux is enabled successfully.

   

   

   If SELinux is still disabled after the restart, run the reboot -f command again.