SELinux Understanding

[Bruno Wolff III]

On Mon, Oct 15, 2007 at 13:57:11 -0400,
  Claude Jones <cjones at levitjames.com> wrote:
> On Monday October 15 2007 1:35:17 pm Nigel Henry wrote:
> > but as
> > re-enabling SELinux, in either permissive, or enforcing mode
> > results in the relabelling process being run, it's almost
> > impossible to know if the relabelling has resolved a genuine
> > problem or not.
> 
> This is where you're mistaken. It's perfectly possible to set 
> permissive and enforcing modes, without relabeling - relabeling 
> is only forced after some updates, and that not very often - 
> perhaps, this is something that should be addressed. Perhaps a 
> warning message when you turn on enforcing, with instructions to 
> relabel if you've run in permissive mode for some period of 
> time...

If you have run with selinux disabled, when you reenable it you are going to
need to check file labels. Any files created while selinux was disabled are
not going to be properly labelled.

Even rebooting a machine can fix a problem, since that will effectively
relabel processes. So if an update didn't happen correctly, a reboot may
fix the problem and getting back to the preupdate state may take some
work.