Product SiteDocumentation Site

7.3.4. Permissive Domains

When SELinux is running in permissive mode, SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode. Previously, it was not possible to make a single domain permissive (remember: processes run in domains). In certain situations, this led to making the whole system permissive to troubleshoot issues.
Fedora 13 includes permissive domains, where an administrator can configure a single process (domain) to run permissive, rather than making the whole system permissive. SELinux checks are still performed for permissive domains; however, the kernel allows access and reports an AVC denial for situations where SELinux would have denied access. Permissive domains are also available in Fedora 9 (with the latest updates applied).
In Red Hat Enterprise Linux 4 and 5, domain_disable_trans Booleans are available to prevent an application from transitioning to a confined domain, and therefore, the process runs in an unconfined domain, such as initrc_t. Turning such Booleans on can cause major problems. For example, if the httpd_disable_trans Boolean is turned on:
The domain_disable_trans Booleans were removed from Fedora 7, even though there was no replacement. Permissive domains solve the above issues: transition rules apply, and files are created with the correct labels.
Permissive domains can be used for:

7.3.4.1. Making a Domain Permissive

To make a domain permissive, run the semanage permissive -a domain command, where domain is the domain you want to make permissive. For example, run the following command as the Linux root user to make the httpd_t domain (the domain the Apache HTTP Server runs in) permissive:
/usr/sbin/semanage permissive -a httpd_t
To view a list of domains you have made permissive, run the semodule -l | grep permissive command as the Linux root user. For example:
# /usr/sbin/semodule -l | grep permissive
permissive_httpd_t      1.0

If you no longer want a domain to be permissive, run the semanage permissive -d domain command as the Linux root user. For example:
/usr/sbin/semanage permissive -d httpd_t