Rocky Linux 9のSELinux無効化手順

#デフォルトの設定内容を確認
[root@test-vm-01 ~]# getenforce
Enforcing

#一時的なSELinux無効化
[root@test-vm-01 ~]# setenforce 0
[root@test-vm-01 ~]# getenforce
Permissive

#SELinuxの設定ファイルを表示
[root@test-vm-01 ~]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
# See also:
# https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/#getting-started-with-selinux-selinux-states-and-modes
#
# NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
# grubby –update-kernel ALL –args selinux=0
#
# To revert back to SELinux enabled:
#
# grubby –update-kernel ALL –remove-args selinux
#
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
# targeted – Targeted processes are protected,
# minimum – Modification of targeted policy. Only selected processes are protected.
# mls – Multi Level Security protection.
SELINUXTYPE=targeted

#grubbyコマンドでSELinuxを無効化(オプションの"-“は2つです)
[root@test-vm-01 ~]# grubby –update-kernel ALL –args selinux=0
[root@test-vm-01 ~]# getenforce
Enforcing

#OS再起動後にSELinuxの設定を確認
[root@test-vm-01 ~]# getenforce
Disabled

#grubbyコマンドでSELinuxの設定を再有効化(オプションの"-“は2つです)
[root@test-vm-01 ~]# grubby –update-kernel ALL –remove-args selinux

#再起動時にファイルのラベル付与
[root@test-vm-01 ~]# fixfiles -F onboot

#OS再起動後にSELinuxの設定を確認
[root@test-vm-01 ~]# getenforce
Enforcing

#configファイルを編集(sedコマンド利用)
[root@test-vm-01 ~]# sed -i -e 's/^SELINUX=enforcing/SELINUX=permissive/g’ /etc/selinux/config

#OS再起動後にSELinuxの設定を確認
[root@test-vm-01 ~]# getenforce
Permissive