RHEL SELinux Configuration – /etc/sysconfig/selinux vs /etc/selinux/config

redhatrhel7selinux

I am running CentOS Linux release 7.5.1804 (Core), and bumped into the usual set SELinux to Permissive task. But then my two sources gave me two different locations where the config should be set:

  1. /etc/sysconfig/selinux

cat /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
  1. /etc/selinux/config

cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     permissive - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of permissive.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

I have read the relevant RedHat forums but nobody seems particularly hung up on either / or.
Also read Selinux – centos – missing /etc/selinux/config, both solutions are there for an answer.

Which one should I use for my current version?

Which one should I use going forward for newer versions?

UPDATE:
They are not symlinked in my system. In fat they are two rather different files:

ls -la /etc/selinux/ | grep config
-rw-r--r--.  1 root root  550 Jan 14 15:55 config
ls -la /etc/sysconfig/ | grep selinux
-rw-r--r--.  1 root root  543 Jan 10 14:12 selinux

Best Answer

From a CentOS 7 system I have to hand, but CentOS 6 and Fedora 31 are the same

lrwxrwxrwx. 1 root root   17 Oct 31  2018 selinux -> ../selinux/config

Seems they are the same file. Personally use /etc/selinx/config due to muscle memory.

but in my system they are different files, size is diff, change time is diff

Then consider that your system is 'broken'. This is easy to test, set permissive in one and enforcing in the other. Reboot ...

Related Topic