3 ms·
SELinux is designed as "mandatory access control," meaning that it is not normally disabled. The normal filesystem permissions of read/write/execute for user/g
by chasil 5y ago
SELinux is designed as "mandatory access control," meaning that it is not normally disabled.
The normal filesystem permissions of read/write/execute for user/group/other are among those known as "discretionary access controls," meaning that they can be relaxed.
The systemd unit security options are discretionary, at the control of the administrator.
- t0astbread 5y agoIs SELinux not also in the administrator's control?
- chasil 5y agoAn administrator can disable it complete with "setenforce 0" and restore it with "setenforce 1" if necessary. The rules can also be adjusted, and there are a number of tunable parameters. The intent is that it is never disabled.