Hello, Everyone During my most recent re-boot, SELinux relabled my entire filesystem. Which would be fine, except for the fact that I have SELinux disabled on my system:
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
Why did SELinux, which is disabled on my system, spend all that time re-labeling my filesystem?
Steven P. Ulrick
On Dec 25, 2013, at 4:25 AM, Steven P. Ulrick meow8282@gmail.com wrote:
Hello, Everyone During my most recent re-boot, SELinux relabled my entire filesystem. Which would be fine, except for the fact that I have SELinux disabled on my system:
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
Why did SELinux, which is disabled on my system, spend all that time re-labeling my filesystem?
Upon disabling selinux, the labels were made incorrect as a result, and at the same time /.autorelabel was created to inform a future selinux enabling to know the system needed to be relabeled on boot, because otherwise it probably would have face planted due to the face the labels were made incorrect by disabling selinux.
A recent selinux update apparently causes /etc/sysconfig/selinux to be ignored, therefore your system came up in enforcing mode and was relabeled.
Instead, you should use enforcing=0 as a boot parameter. It can be added to /etc/default/grub, and then use grub2-mkconfig to recreate grub.cfg and make the change persistent. enforcing=0 maintains the correct labels, reports AVC denials, but doesn't actually enforce them.
selinux=0 isn't a good idea. Discussed here: http://danwalsh.livejournal.com/10972.html
Chris Murphy
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 12/25/2013 06:25 AM, Steven P. Ulrick wrote:
Hello, Everyone During my most recent re-boot, SELinux relabled my entire filesystem. Which would be fine, except for the fact that I have SELinux disabled on my system:
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
Why did SELinux, which is disabled on my system, spend all that time re-labeling my filesystem?
Steven P. Ulrick
There was a bug in libselinux update that caused this problem, it should now be fixed in libselinux-2.2.1-6.fc20
-
Chris Murphy -
Daniel J Walsh -
Steven P. Ulrick