How to Disable SELinux on Fedora Linux

Security-Enhanced Linux (SELinux) provides mandatory access control that protects Fedora systems from unauthorized access and privilege escalation. While SELinux significantly strengthens security, you may need to disable it temporarily when troubleshooting application compatibility issues, testing custom software that conflicts with security policies, or working in development environments where strict access controls interfere with rapid iteration. Common scenarios include debugging Docker containers that fail under enforcing mode, testing legacy applications without SELinux-aware packaging, or isolating whether SELinux policies cause service startup failures.

This guide walks through temporarily disabling SELinux for troubleshooting sessions and permanently disabling it when necessary, then covers the complete re-enable process including the critical filesystem relabeling step. By the end, you will understand the three operational modes, know how to switch between them safely, and recognize when full kernel-level disablement via grubby is required on modern Fedora releases.

SELinux Mode Overview

SELinux operates in three distinct modes that control how security policies are applied. Understanding these modes helps you choose the right approach for troubleshooting or development work.

Enforcing Mode

• SELinux actively enforces all security policies
• Denies any operation that violates security policies
• Logs all policy violations to /var/log/audit/audit.log
• Production systems requiring maximum security should use this mode

Permissive Mode

• SELinux identifies and logs policy violations but does not block them
• Allows you to test policy changes without disrupting services
• Useful for troubleshooting whether SELinux causes application failures
• Resets to enforcing mode after system reboot unless permanently configured

Disabled Mode

• SELinux security module is completely inactive
• No policy enforcement or logging occurs
• Removes the additional security layer SELinux provides
• Requires filesystem relabeling when re-enabling to restore security contexts

Temporarily Disable SELinux

Switching to permissive mode disables enforcement without requiring a reboot, making it ideal for troubleshooting. This change persists only until the next reboot, after which SELinux returns to its configured mode.

sudo setenforce 0

On minimal Fedora installations or containers, the setenforce and sestatus commands may be missing. Install the utilities package if needed: sudo dnf install policycoreutils -y. Standard Fedora Workstation and Server editions include these tools by default.

Verify the mode changed successfully:

getenforce

Permissive

The output confirms SELinux switched to permissive mode. SELinux logs policy violations to /var/log/audit/audit.log but does not block them, allowing you to identify whether SELinux caused the issue you are troubleshooting.

Permanently Disable SELinux

Permanent disablement requires modifying the SELinux configuration file. This change prevents SELinux from loading its policy at boot time.

Open the configuration file using your preferred text editor:

sudo nano /etc/selinux/config

Find the line SELINUX=enforcing and change it to:

SELINUX=disabled

Save the changes (Ctrl+O, Enter) and exit (Ctrl+X).

On modern Fedora releases, setting SELINUX=disabled prevents the policy from loading but does not fully disable SELinux at the kernel level. For complete disablement, use the grubby method to add selinux=0 to the kernel command line: sudo grubby --update-kernel ALL --args selinux=0. To revert this later, run: sudo grubby --update-kernel ALL --remove-args selinux=0. The configuration file method shown above is sufficient for most troubleshooting and development scenarios.

Reboot the system to apply the configuration change:

sudo reboot

After the system restarts, verify SELinux is fully disabled:

sestatus

SELinux status:                 disabled

The output confirms SELinux is completely disabled. The system loads no policies and enforces no mandatory access controls until you re-enable SELinux.

Re-Enable SELinux

Reactivating SELinux requires modifying the configuration and triggering a filesystem relabel. Skipping the relabel step can cause boot failures or severe permission errors.

Open the configuration file:

sudo nano /etc/selinux/config

Change the line back to SELINUX=enforcing (or permissive).

Next, create the autorelabel file to force the system to relabel the filesystem on the next boot:

sudo touch /.autorelabel

Reboot the system:

sudo reboot

Note: The boot process will take longer than usual as the system relabels all files. Do not interrupt this process.

Once the reboot completes, verify SELinux is active:

sestatus

SELinux status:                 enabled
Current mode:                   enforcing

Troubleshooting Common Issues

Filesystem Relabeling Takes Extremely Long

After you re-enable SELinux following a period of disablement, the system relabels every file with the correct security context. On systems with large filesystems or millions of files, this process can take 30 minutes or longer.

During relabeling, you will see:

*** Warning -- SELinux targeted policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
***

Monitor progress by switching to a different virtual console (Ctrl+Alt+F2) and checking the relabeling log:

sudo tail -f /var/log/messages | grep setfiles

Do not interrupt the relabeling process. If you cancel it, the system will remain in an inconsistent state that requires a forced relabel on the next boot by recreating the /.autorelabel file.

System Fails to Boot After Configuration Change

If you encounter boot failures after modifying /etc/selinux/config, the configuration file may contain syntax errors or an invalid mode value.

Boot into rescue mode by selecting the rescue kernel from the GRUB menu, then check the configuration file:

sudo cat /etc/selinux/config | grep SELINUX=

Valid values are enforcing, permissive, or disabled. Correct any typos and reboot. If the file is severely corrupted, recreate it with the default content:

sudo tee /etc/selinux/config <<EOF
SELINUX=enforcing
SELINUXTYPE=targeted
EOF

Application Still Blocked After Switching to Permissive Mode

If an application continues failing after switching to permissive mode, the issue is not SELinux-related. Verify the current mode is actually permissive:

getenforce

Permissive

Check the application’s logs and system journal for the actual error:

sudo journalctl -xe

Common non-SELinux causes include firewall rules blocking network connections, incorrect file permissions, missing dependencies, or configuration errors. For network services, verify firewall rules allow the required ports. See our guides on configuring Firewalld on Fedora and securing SSH access on Fedora.

Denied Operations Still Appearing in Audit Log After Disable

After setting SELINUX=disabled in the configuration file, SELinux continues running until you reboot. Check the actual status:

sestatus

If the output shows Current mode: enforcing or permissive, the configuration change has not taken effect yet. Reboot the system to apply the configuration file changes. If you need immediate disablement without rebooting, use sudo setenforce 0 to switch to permissive mode temporarily.

Closing Thoughts

You now understand how to switch SELinux between enforcing, permissive, and disabled modes depending on your troubleshooting or development needs. The temporary setenforce method provides quick testing without persistence, while the configuration file approach creates permanent changes. When re-enabling SELinux after disablement, the /.autorelabel file triggers the critical filesystem relabeling process that restores security contexts—never skip this step or you risk boot failures and permission errors. For systems where SELinux remains disabled during extended troubleshooting, compensate with properly configured firewall rules and intrusion prevention tools. See our guides on configuring Firewalld on Fedora, setting up Fail2Ban with Firewalld, and installing ClamAV antivirus on Fedora for additional security layers.