View a markdown version of this page

Change to permissive mode - Amazon Linux 2027
Editing the config file to enable permissive modeUsing cloud-init to enable permissive mode
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Change to permissive mode

When you run SELinux in permissive mode, SELinux policy isn't enforced. In permissive mode, SELinux logs AVC messages but doesn't deny operations. You can use these AVC messages for troubleshooting, debugging, and SELinux policy improvements.

To find the current SELinux mode, run the getenforce command.

getenforce
Enforcing

Editing the config file to enable permissive mode

To change the mode to permissive, use the following steps.

  1. Edit the /etc/selinux/config file to change to permissive mode. The SELINUX value should look like the following example.

    SELINUX=permissive

  2. Restart your system to complete the change to permissive mode.

    $ sudo reboot

Using cloud-init to enable permissive mode

As an alternative, when you launch your instance, pass the following cloud-config as user-data to enable permissive mode. 

#cloud-config
selinux:
  mode: permissive

By default, this setting causes the instance to reboot. For greater stability, we recommend rebooting your instance. However, if you prefer, you can skip the reboot by providing the following cloud-config.

#cloud-config
selinux:
  mode: permissive
  selinux_no_reboot: 1