http://www.crypt.gen.nz/selinux/disable_selinux.html

How to Disable SELinux

You’ve setup a new system, or installed something new on your Linux system and its not working. You get the feeling that SELinux is the cause of the problem. This page was written to help.

Contents

Overview
Should you really disable SELinux?
Temporarily switch off enforcement
Permanently Permissive
Fully Disabling SELinux
Re-Enabling SELinux

Overview

SELinux has two major components on your system. There’s the kernel mechanism which is enforcing a bunch of access rules which apply to processes and files. And secondly, there’s file labels : every file on your system has extra labels attached to it which tie-in with those access rules. Run ls -Z and you’ll see what I mean.

Should you really disable SELinux?

Be aware that by disabling SELinux you will be removing a security mechanism on your system. Think about this carefully, and if your system is on the Internet and accessed by the public, then think about it some more. Joshua Brindle (an SELinux developer) has comments on disabling SELinux here, which states clearly that applications should be fixed to work with SELinux, rather than disabling the OS security mechanism.

You need to decide if you want to disable SELinux temporarily to test the problem, or permanently switch it off. It may also be a better option to make changes to the policy to permit the operations that are being blocked - but this requires knowledge of writing policies and may be a steep learning curve for some people. For the operating system as a whole, there is two kinds of disabling:

• Permissive - switch the SELinux kernel into a mode where every operation is allowed. Operations that would be denied are allowed and a message is logged identifying that it would be denied. The mechanism that defines labels for files which are being created/changed is still active.
• Disabled - SELinux is completely switched off in the kernel. This allows all operations to be permitted, and also disables the process which decides what to label files & processes with.

Disabling SELinux could lead to problems if you want to re-enable it again later. When the system runs with file labelling disable it will create files with no label - which could cause problems if the system is booted into Enforcement mode. A full re-labelling of the file system will be necessary.

Temporarily switch off enforcement

You can switch the system into permissive mode with the following command:

echo 0 >/selinux/enforce

You’ll need to be logged in as root, and in the sysadm_r role:

newrole -r sysadm_r

To switch back into enforcing mode:

echo 1 >/selinux/enforce

In Fedora Core and RedHat Enterprise Linux you can use the setenforce command with a 0 or 1 option to set permissive or enforcing mode, its just a slightly easier command than the above.To check what mode the system is in,

cat /selinux/enforce

which will print a “0″ or “1″ for permissive or enforcing - probably printed at the beginning of the line of the command prompt.

Permanently Permissive

The above will switch off enforcement temporarily - until you reboot the system. If you want the system to always start in permissive mode, then here is how you do it.In Fedora Core and RedHat Enterprise, edit /etc/selinux/config and you will see some lines like this:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

… just change SELINUX=enforcing to SELINUX=permissive, and you’re done. Reboot if you want to prove it.For the other Linuxes which don’t have the /etc/selinux/config file, you just need to edit the kernel boot line, usually in /boot/grub/grub.conf if you’re using the GRUB boot loader. On the kernel line, add enforcing=0 at the end. For example,

title SE-Linux Test System
	root (hd0,0)
	kernel /boot/vmlinuz-2.4.20-selinux-2003040709 ro root=/dev/hda1 nousb enforcing=0
	#initrd /boot/initrd-2.4.20-selinux-2003040709.img

Fully Disabling SELinux

Fully disabling SELinux goes one step further than just switching into permissive mode. Disabling will completely disable all SELinux functions including file and process labelling.In Fedora Core and RedHat Enterprise, edit /etc/selinux/config and change the SELINUX line to SELINUX=disabled:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

… and then reboot the system.For the other Linuxes which don’t have the /etc/selinux/config file, you just need to edit the kernel boot line, usually in /boot/grub/grub.conf, if you’re using the GRUB boot loader. On the kernel line, add selinux=0 at the end. For example,

title SE-Linux Test System
        root (hd0,0)
        kernel /boot/vmlinuz-2.4.20-selinux-2003040709 ro root=/dev/hda1 nousb selinux=0
        #initrd /boot/initrd-2.4.20-selinux-2003040709.img

You will have to reboot to disable SELinux, you just can’t do it while the system is running.

Re-Enabling SELinux

If you’ve disabled SELinux as in the section above, and you want to enable it again then you’ve got a bit of work to do. The problem will be that files created or changed when SELinux was disabled won’t have the correct file labels on them - if you just reboot in enforcing mode then a lot of stuff won’t work properly.What you need to do is to enable SELinux by editing /etc/selinux/config (for Fedora/RedHat) or by adding selinux=1 to the kernel boot line, then boot into permissive mode, then relabel everything, and then reboot into (or simply switch to) enforcing mode.

After booting into permissive mode, run fixfiles relabel

Alternatively, in Fedora and RedHat Enterprise Linux you can touch /.autorelabel and reboot or put autorelabel on the boot command line ( in both cases the system gets a full relabel early in the boot process ). Note that this can take quite some time for systems with a large number of files.

After relabelling the filesystem, you can switch to enforcing mode (see above) and you system should be fully enforcing again.

http://mylittlebussiness.blogspot.com/2007/05/guide-to-useless-services-windows-xp.html

29 Useless Services are no longer required. (Windows XP SP2)

An operating system is made up of various components that work with each other. The OS isn’t just one object - it’s a collection of smaller objects, each of which performs a different task. Their conjunction is what makes an “operating system”. Windows calls these components “services”, Linux calls it “daemons” and so on. Each service in Windows is essentially, to put it in a simpler way, an application that stays running in the back doing its job when required. Now each service takes up some memory, which isn’t good if your system has a low amount of memory (like 256MB or less). Fortunately, not all of the default services are required by all users, so you can turn some of them off to free up some memory.

In this guide, we’ll take a look at the default set of services that come with a fresh installation of Windows XP with Service Pack 2. We’ll tell you the ones that you don’t need and try to tell you why, so you can disable them without any problems. Each service has three options: automatic, manual and disabled. Automatic is essentially “run at startup”; Manual is a service that is started only when required; Disabled is when a service doesn’t start at all. Based on the type of a user you are, there are different settings to recommend, but we’ll take the safe route and tell you to disable the services that won’t cause important features of your Windows to stop working. If you’re comfortable with trying out stunts, you can go ahead and disable some of the other services that aren’t mentioned here. If something stops working, you can just turn the service back on - there’s no permanent effect. Also, since this is a guide to unneeded services that can be disabled, we won’t list the services that are already disabled after Service Pack 2 (like Alerter and Messenger) in an effort to keep the list as simple as possible.

One more thing you have to note is that this list is primarily aimed at home users, so we’ll be taking out most of the intranet/network related services that don’t affect Internet connectivity. If you’re using an office workstation with a proper server and all that jazz, you shouldn’t be reading this guide.

To enable or disable services, go to Start -> Run -> and type “services.msc” and hit Enter.

Computer Browser

“Maintains an updated list of computers on the network and supplies this list to computers designated as browsers.”

Contrary to what it may sound like, disabling this service still allows you to browse a network in your office. And of course, you don’t need this at home. Disable it.

Distributed Link Tracking Client

“Maintains links between NTFS files within a computer or across computers in a network domain.”

This one sounds useful, but only if you often create files on one computer, shortcuts to those files on another computer, and then move the original files around the network. Not many people do so. In fact, not many people even have NTFS on their Windows for some orthodox reason. Not required on FAT32, at home or even at work if your scenario doesn’t match with the description. Disable it.

Error Reporting Service

“Allows error reporting for services and applictions running in non-standard environments.”

I.e. “Send system information to Microsoft.” No thanks. Disable it.

Help and Support

“Enables Help and Support Center to run on this computer.”

This is okay to leave as-is if you hit F1 a lot, but if you almost never need to use the built-in help features (as opposed to just Googling for the problem - always a better option), then disabling this service would be a good idea. Now the problem is that the service automatically gets turned back on when required even if its disabled, so keeping it disabled is actually a better option to keeping it on automatic.

Indexing Service

“Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.”

Use AvaFind (link to review) and/or Google Desktop Search instead. Just disable it - no questions asked.

Net Logon

“Supports pass-through authentication of account logon events for computers in a domain.”

Useless for single machines or even most networks out here that don’t actually have a domain. Disable.

NetMeeting Remote Desktop Sharing

“Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet.”

As a general rule of thumb, avoid any combination of “remote” and “internet/intranet”. If you don’t want people to use NetMeeting to connect to your computer and see your desktop over the Internet/Intranet, disable this please.

Network Location Awareness (NLA)

“Collects and stores network configuration and location information, and notifies applications when this information changes.”

And how is that going to help you? Disable it.

Network Provisioning Service

“Manages XML configuration files on a domain basis for automatic network provisioning.”

Not necessary for home and/or simple networks. Disable.

Performance Logs and Alerts

“Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert.”

There are other, more efficient ways of tracking performance of your machine(s) than using this service, if at all you need to do so. Most home users will never need it. Disable it.

Portable Media Serial Number Service

“Retrieves the serial number of any portable media player connected to this computer.”

Unless you use some 100% Windows Media based/compatible (”PlaysForSure”) portable audio/video device and Windows Media Player, this service is useless. iPod and regular flash based MP3 player users don’t need it. Disable it.

QoS RSVP

“Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.”

This is an interesting concept to give more bandwidth to applications that request it, unfortunately, not many actually do this QoS thing, so it doesn’t make sense to enable it. You can use cFos Speed for better bandwidth prioritization that actually works.

Remote Desktop Help Session Manager

“Manages and controls Remote Assistance.”

Remote Assistance should be avoided. Disable this service.

Remote Registry

“Enables remote users to modify registry settings on this computer.”

We’ll let you guess this one out…

Secondary Logon

“Enables starting processes under alternate credentials.”

This offers the “Run As” option to limited user accounts to be able to temporarily run some applications as an administrator (after entering the password, of course). Standalone machines usually have just one account with administrator access and other accounts, if any, are also usually administrators. You should keep this service only if your limited users often need to run applications with admin access, otherwise disable it.

Security Center

“Monitors system security settings and configurations.”

That thing that pops up and tells you when your firewall is down, your anti-virus is out of date, or automatic updates are turned off. Personally, I like the alerts because then I know my anti-virus was unable to download its updates. I don’t really bother with the firewall and my automatic updates are always on. If you’ve never needed or received any alerts on these events, this service can be disabled. The feature doesn’t offer any protection by itself - it is only a monitor. Not really required.

Server

“Supports file, print, and named-pipe sharing over the network for this computer.”

Only if you share files on a network would this be required. If you disable the Server service, you may still be able to access other shares, so you won’t be entirely unconnected. Decide and disable if not required.

Smart Card

“Manages access to smart cards read by this computer.”

How many of you actually use smart cards with your computer? Disable this.

SSDP Discovery Service

“Enables discovery of UPnP devices on your home network.”

Most people don’t have any UPnP devices on the network, so this service is useless. Do not confuse this with standard PnP (Plug-n-Play), which remains unaffected if this service is disabled.

System Restore Service

“Performs system restore functions.”

I prefer trying to manually troubleshoot and fix, or reinstalling Windows in case of a fatal problem. I’ve never felt comfortable with using System Restore to “restore old versions of files” and all that, so I keep it disabled. It frees up memory and a good amount of disk space as well.

TCP/IP NetBIOS Helper

“Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.”

Nobody uses NetBIOS anymore. Get over it. Disable this.

Themes

“Provides user experience theme management.”

For performance reasons (or if you’re just bored of all Blue), you may want to use the classic Windows 2000-style interface. You can switch to it from the Desktop Properties dialog, but there’s no reason to have the service running if you’re not using Luna / Default Blue, so disable it. Remember: if you’re using the Luna / Default Blue interface, this service is necessary.

Uninterruptible Power Supply

“Manages an uninterruptible power supply (UPS) connected to the computer.”

If you don’t have a UPS, you don’t need this service. If you have a UPS that you use independent of the computer (i.e. without automatic turn off etc.), you don’t need this service. Even if you do have a UPS that requires installing its own software for power management, this service is not required. Use it only if your UPS connects to your PC via a COM port and automatically gets Windows to work with it (not many).

Universal Plug and Play Device Host

“Provides support to host Universal Plug and Play devices.”

Works along with the SSDP service that we doubt you require. Don’t know what UPnP is? Disable this.

WebClient

“Enables Windows-based programs to create, access, and modify Internet-based files.”

Not a very popular feature. Disable it. If some features in Internet Explorer don’t work for you, then you may need it. But then, why are you using IE, again? Huh?

Windows Time

“Maintains date and time synchronization on all clients and servers in the network.”

I’ve kept this on. In fact, I’m so particular about having the correct time on my system, I’ve actually increased the update frequency from weekly to daily. If you don’t share the same enthusiasm as me, you can disable this service. You can use a freeware, third party, on-demand time sync utility that will not need this service to be running, saving you memory.

Wireless Zero Configuration

“Provides automatic configuration for the 802.11 adapters”

I don’t have any WiFi devices or networks to get on to, so I’ve disabled it. If you don’t have any WiFi, do the same.

WMI Performance Adapter

“Provides performance library information from WMI HiPerf providers.”

Nobody is really sure what to do with this thing. I’ve never needed it, and it’s unlikely that you ever will. Off with it.

Workstation

“Creates and maintains client network connections to remote servers.”

If your’re sharing files and folders over a network, leave this on. If not, disable it. This is not needed or even utilized in a standalone PC. This doesn’t affect Internet connectivity.

That’s it. These are the 29 services that “are no longer required.” You can get rid of on your Windows XP SP2 system to free up some memory and CPU and gain some performance out of it. We haven’t thought about doing a similar guide for Windows 2000, but if you guys really want one, do post comments asking for it. Have a nice evening and a very happy new year!

See more articles on this topic:

• A faster Windows XP? Here’s how!
• 10 Unknown Windows Freeware Applications You Should Know About
• 16 Hidden Windows XP Goodies
• List of the keyboard shortcuts that are available in Windows XP

http://fastwindows.blogspot.com/2006/09/faster-windows-xp-heres-how.html

A faster Windows XP? Here’s how!

A recent study of our team on how to better our Windows XP systems comissioned to create an eBook on the subject for the main team at MPortela led us to investigate a countless number of details on how to better your performance and machine.

Some of the working tweaks you can do to your Windows XP can really be a blessing to your system’s speed. So I thought about sharing with you the safe tweaks on how to have a faster Windows XP. As a disclaimer do the following tweaks at your own risk, however they were all tested and are in use by most of our team members and friends.

A. DISABLE INDEXING SERVICES

Indexing Services is a small little program that uses large amounts of RAM and can often make a computer endlessly loud and noisy. This system process indexes and updates lists of all the files that are on your computer. It does this so that when you do a search for something on your computer, it will search faster by scanning the index lists. If you don’t search your computer often, or even if you do search often, this system service is completely unnecessary. To disable do the following:

1. Go to Start
2. Click Settings
3. Click Control Panel
4. Double-click Add/Remove Programs
5. Click the Add/Remove Window Components
6. Uncheck the Indexing services
7. Click Next

B. OPTIMISE DISPLAY SETTINGS

Windows XP can look sexy but displaying all the visual items can waste system resources. To optimise:

1.Go to Start
2. Click Settings
3. Click Control Panel
4. Click System
5. Click Advanced tab
6. In the Performance tab click Settings
7. Leave only the following ticked:
- Show shadows under menus
- Show shadows under mouse pointer
- Show translucent selection rectangle
- Use drop shadows for icons labels on the desktop
- Use visual styles on windows and buttons

C. SPEEDUP FOLDER BROWSING

You may have noticed that everytime you open my computer to browse folders that there is a slight delay. This is because Windows XP automatically searches for network files and printers everytime you open Windows Explorer. To fix this and to increase browsing significantly:

1. Open My Computer
2. Click on Tools menu
3. Click on Folder Options
4. Click on the View tab.
5. Uncheck the Automatically search for network folders and printers check box
6. Click Apply
7. Click Ok
8. Reboot your computer

D. IMPROVE MEMORY USAGE

Cacheman Improves the performance of your computer by optimizing the disk cache, memory and a number of other settings.
NOTE: This program is shareware and some features require activation.
Once Installed:

1.Go to Show Wizard and select All
2.Run all the wizards by selecting Next or Finished until you are back to the main menu. Use the defaults unless you know exactly what you are doing.
3.Exit and Save Cacheman
4.Restart Windows

E. OPTIMISE YOUR INTERNET CONNECTION

There are lots of ways to do this but by far the easiest is to run TCP/IP Optimizer.

1. Download and install
2. Click the General Settings tab and select your Connection Speed (Kbps)
3. Click Network Adapter and choose the interface you use to connect to the Internet
4. Check Optimal Settings then Apply
5. Reboot

F. OPTIMISE YOUR PAGEFILE

If you give your pagefile a fixed size it saves the operating system from needing to resize the page file.

1. Right click on My Computer and select Properties
2. Select the Advanced tab
3. Under Performance choose the Settings button
4. Select the Advanced tab again and under Virtual Memory select Change
5. Highlight the drive containing your page file and make the initial Size of the file the same as the Maximum Size of the file.

Windows XP sizes the page file to about 1.5X the amount of actual physical memory by default. While this is good for systems with smaller amounts of memory (under 512MB) it is unlikely that a typical XP desktop system will ever need 1.5 X 512MB or more of virtual memory. If you have less than 512MB of memory, leave the page file at its default size. If you have 512MB or more, change the ratio to 1:1 page file size to physical memory size.

G. SPEEDUP FOLDER ACCESS - DISABLE LAST ACCESS UPDATE

If you have a lot of folders and subdirectories on your computer, when you access a directory XP wastes a lot of time updating the time stamp showing the last access time for that directory and for ALL sub directories. To stop XP doing this you need to edit the registry. If you are uncomfortable doing this then please do not attempt.

1. Go to Start and then Run and type “regedit”
2. Click through the file system until you get to “HKEY_LOCAL_MACHINE\ System\CurrentControlSet\Control\FileSystem”
3. Right-click in a blank area of the window on the right and select ‘DWORD Value’
4. Create a new DWORD Value called ‘NtfsDisableLastAccessUpdate’
5. Then Right click on the new value and select ‘Modify’
6. Change the Value Data to ‘1′
7. Click ‘OK’

H. MAKE YOUR MENUS LOAD FASTER

This is one of my favourite tweaks as it makes a huge difference to how fast your machine will ‘feel’. What this tweak does is remove the slight delay between clicking on a menu and XP displaying the menu.

1. Go to Start then Run
2. Type ‘Regedit’ then click ‘Ok’
3. Find “HKEY_CURRENT_USER\Control Panel\Desktop\”
4. Select “MenuShowDelay”
5. Right click and select “Modify’
6. Reduce the number to around “100″
7. This is the delay time before a menu is opened. You can set it to “0″ but it can make windows really hard to use as menus will open if you just look at them - well move your mouse over them anyway. I tend to go for anywhere between 50-150 depending on my mood

I. IMPROVE XP SHUTDOWN SPEED

This tweak reduces the time XP waits before automatically closing any running programs when you give it the command to shutdown.

1. Go to Start then select Run
2. Type ‘Regedit’ and click ok
3. Find ‘HKEY_CURRENT_USER\ Control Panel\Desktop\’
4. Select ‘WaitToKillAppTimeout’
5. Right click and select ‘Modify’
6. Change the value to ‘1000′
7. Click ‘OK’
8. Now select ‘HungAppTimeout’
9. Right click and select ‘Modify’
10. Change the value to ‘1000′
11. Click ‘OK’
12. Now find ‘HKEY_USERS\ .DEFAULT\Control Panel\Desktop’
13. Select ‘WaitToKillAppTimeout’
14. Right click and select ‘Modify’
15. Change the value to ‘1000′
16. Click ‘OK’
17. Now find ‘HKEY_LOCAL_MACHINE\ System\CurrentControlSet\Control\’
18. Select ‘WaitToKillServiceTimeout’
19. Right click and select ‘Modify’
20. Change the value to ‘1000′
21. Click ‘OK’

J. IMPROVE SWAPFILE PERFORMANCE

If you have more than 256MB of RAM this tweak will considerably improve your performance. It basically makes sure that your PC uses every last drop of memory (faster than swap file) before it starts using the swap file.

1. Go to Start then Run
2. Type “msconfig.exe” then ok
3. Click on the System.ini tab
4. Expand the 386enh tab by clicking on the plus sign
5. Click on new then in the blank box type”ConservativeSwapfileUsage=1″
6. Click OK
7. Restart PC

K. ENSURE XP IS USING DMA MODE

XP enables DMA for Hard-Drives and CD-Roms by default on most ATA or ATAPI (IDE) devices. However, sometimes computers switch to PIO mode which is slower for data transfer - a typical reason is because of a virus. To ensure that your machine is using DMA:

1. Open ‘Device Manager’
2. Double-click ‘IDE ATA/ATAPI Controllers’
3. Right-click ‘Primary Channel’ and select ‘Properties’ and then ‘Advanced Settings’
4. In the ‘Current Transfer Mode’ drop-down box, select ‘DMA if Available’ if the current setting is ‘PIO Only’
See more articles on this topic:

• Improving Windows XP Boot Time on your Old Computer
• 10 Unknown Windows Freeware Applications You Should Know About
• List of the keyboard shortcuts that are available in Windows XP
• 29 Useless Services are no longer required. (Windows XP SP2)