Re: autorelabel => reboot loop

[Robin Lee Powell]

On Sun, Oct 23, 2016 at 07:54:26PM +0100, Trevor Hemsley wrote:
>  On 23/10/16 19:40, Robin Lee Powell wrote:
>  > This is on a rawhide machine on which I just ran dnf upgrade, touch
>  > /.autorelabel, and rebooted.  It's now stuck in a reboot loop.
>  >
>  > The important part is probably:
>  >
>  > rm: cannot remove '/.autorelabel': Permission denied
>  
>  Try passing enforcing=0 as part of the kernel parameters. 
If I have to do that, isn't that a bug?

autorelabel => reboot loop

[Vit Mojzis]

On 10/23/2016 09:07 PM, Robin Lee Powell wrote:
>  On Sun, Oct 23, 2016 at 07:54:26PM +0100, Trevor Hemsley wrote:
> > On 23/10/16 19:40, Robin Lee Powell wrote:
> >> This is on a rawhide machine on which I just ran dnf upgrade, touch
> >> /.autorelabel, and rebooted.  It's now stuck in a reboot loop.
> >>
> >> The important part is probably:
> >>
> >> rm: cannot remove '/.autorelabel': Permission denied
> > Try passing enforcing=0 as part of the kernel parameters.
>  If I have to do that, isn't that a bug? 
It is
(https://bugzilla.redhat.com/show_bug.cgi?id=1351358), but running 
SELinux in permissive mode every time autorelabel is to be executed 
could introduce vulnerabilities. Therefore we are looking for a better 
solution.

For more information please read this discussion:
https://lists.fedoraproject.org/archives/list/[e-mail].o...

>  _______________________________________________
>  selinux mailing list -- selinux(a)lists.fedoraproject.org
>  To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org

autorelabel => reboot loop

[Petr Lautrbach]

On Sun, Oct 23, 2016 at 12:07:45PM -0700, Robin Lee Powell wrote:
>  
>  
>  On Sun, Oct 23, 2016 at 07:54:26PM +0100, Trevor Hemsley wrote:
>  > On 23/10/16 19:40, Robin Lee Powell wrote:
>  > > This is on a rawhide machine on which I just ran dnf upgrade, touch
>  > > /.autorelabel, and rebooted.  It's now stuck in a reboot loop.
>  > >
>  > > The important part is probably:
>  > >
>  > > rm: cannot remove '/.autorelabel': Permission denied
>  > 
>  > Try passing enforcing=0 as part of the kernel parameters.
>  
>  If I have to do that, isn't that a bug? 
Generally autorelabel works in enforcing mode and you don't need to
switch to permissive. However there can be corner cases when a
filesystem is mislabeled in a way that even init process runs with a
wrong SELinux type and you need to switch to permissive on
boot manually.

Petr