Enable or Disable Permissive Domain in SELinux policy on Linux

SELinux有三种运行模式：Enforcing、Permissive和Disabled。Enforcing模式下，任何违反策略的行为都会被拒绝；Permissive模式只记录违规行为但不阻止，用于 ...

若要將模式變更為 enforcing ，請使用下列步驟。 編輯 /etc/selinux/config 檔案以變更為 enforcing 模式。 SELINUX 設定看起來應如下列範例所示。 ... 重新啟動系統以完成對 ...

When SELinux is running in permissive mode, SELinux policy is not enforced. The system remains operational and SELinux does not deny any operations but only ... Permanent changes in... · Enabling SELinux · Changing to enforcing mode

When enabled, SELinux can run in one of two modes: enforcing or permissive. The following sections show how to permanently change into these modes.

当SELinux 是以permissive 模式运行时，不会强制SELinux 策略。系统可保持正常操作，SELinux 不会拒绝任何操作，而只是记录AVC 信息，它们可用于故障排除、调试和SELinux 策略 ...

根據上圖的箭頭，你可以知道disabled, permissive 模式下，其實SELinux 並不會真的進行程序存取的管制！ 只有enforcing 模式才會真的進行各個項目的管理！

SELinux can operate in two global modes: Permissive mode, in which permission denials are logged but not enforced. Enforcing mode, in which ... Validate SELinux · Implement SELinux · SELinux concepts · Customize SELinux

Switching between enforcing and permissive. The purpose of supporting permissive policies is to allow a system to run with SELinux enabled, ...

Yes, you are less secure on permissive than enforcing, but any root script can change the /etc/selinux/config file, put permissive instead of ...