Updated: 28 September 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9
RHEL/CentOS 6 and 7 are end of life. On AlmaLinux 9 / Rocky Linux 9 SELinux is enabled and enforcing by default. Before turning it off, consider fixing the actual problem: most denials are solved with the right file context or boolean (see "What is the Command output for 3 SELinux sestatus ?" and the semanage guide).
Check the mode
getenforce # Enforcing, Permissive or Disabled sestatus
Temporarily (until reboot)
setenforce 0 # permissive: nothing is blocked, denials are only logged setenforce 1 # back to enforcing
Permanently permissive
Set SELINUX=permissive in /etc/selinux/config and reboot. Denials are still logged in /var/log/audit/audit.log, which helps you write the right fix later.
Disable completely
On version 9, SELINUX=disabled in the config file no longer switches SELinux off completely. Use the kernel argument instead, then reboot:
grubby --update-kernel ALL --args selinux=0 # to turn it back on: grubby --update-kernel ALL --remove-args selinux touch /.autorelabel && reboot
Note: cPanel & WHM requires SELinux to be disabled; its installer tells you if it is still on. When you enable SELinux again, the relabel at the next boot can take several minutes.
