My guess is you can run a service (a process) in unconfined mode. Example:
chcon -t unconfined_exec_t /usr/sbin/httpd
I am not sure if this is what you want, I can only guess it is not much secure to do it in production...
I wanted to know suppose like my NetworkManager has some issues with SELinux and I just wan't to disable or set the mode to permissive for NetworkManager, can I do it ..rather than playing with the SELinux settingd for the whole system. Keeping the process unconfined can be the solution.
SELinux have permissive domains, that allows you to put confined application in permissive mode regardless of SELinux enforcing mode.
semanage permissive -l - will list you all security domains (context in which application runs) that are in permissive mode.
semanage permissive -a domain_t - will add this domain to permissive list, eg.: semanage permissive -a httpd_t - will move apache to permissive mode.
There is one thing you can do to fix this
1 set SE Linux on Permissive
2 Monitor SE Linux Logs (/var/log/audit/audit.log) and grep the Network Manager AVC Denials
3 Copy them in a separate file say seerror.txt
4 now use audit2allow to create a policy file
audit2allow -M mypol -i /path to seerror.txt
This will create a policy file mypol.pp
Now load the policy using semodule
semodule -i mypol.pp
Selinux is system enabled and you cannot turn it off for a service. If you are having problems with a service you can put it in permissive mode and look if it's working and if any selinux alert is showing.
sudo getenforce
> Enforcing
Change to permissive until next reboot
sudo setenforce 0
sudo getenforce
> Permissive
Restart your service so that it runs in the new applied mode...
Asked: 2011-11-18 15:03:54 -0600
Seen: 1,887 times
Last updated: Aug 07 '13
Ask Fedora is community maintained and Red Hat or Fedora Project is not responsible for content. Content on this site is licensed under a CC-BY-SA 3.0 license.