SELinux CentOS8 – Why Errors Occur in Permissive Mode

centos8selinux

I have set CentOS 8 Stream with SELinux set to permissive but I still have bunch of red lines in the log e.g.:

SELinux is preventing /usr/lib/systemd/systemd from name_connect access on the tcp_socket port 80

Are these real or its just printing – what would be happening if it was in restrictive mode?

Best Answer

Per the documentation:

When SELinux is running in permissive mode, SELinux policy is not enforced. The system remains operational and SELinux does not deny any operations but only logs AVC messages, which can be then used for troubleshooting, debugging, and SELinux policy improvements.

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/changing-selinux-states-and-modes_using-selinux

Also see /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
SELINUX=permissive
Related Topic