New selinux problem [weird!]

[François Patte]

Bonjour,

For some reason (I explain later) I disabled selinux in 
/etc/selinux/config file.

When I re-enabled selinux (SELINUX=enforcing in the config file) I could 
not restart my system: no service could start and I got a kernel panic.

I had to rescue my system (see my other post) and disabled selinux.

Why??? I remember that long ago, when you enabled selinux boot could 
last a long time waiting for the indexation of files, but I have never 
seen a kernel panic.

So, how do I proceed to re-enable selinux on my system?

Thank you.

PS. I disabled selinux because it prevented to start a service (dictd, 
see my post) but it was a wrong message of selinux alert: the problem 
was not selinux but the upgrade from f32 to f34 which had changed the 
owner of the dictd.log file (dictd changed to root).

This is a second wrong message with the one of the rescue tool (see my 
post on rescue)

-- 
François Patte
UFR de mathématiques et informatique
Laboratoire CNRS MAP5, UMR 8145
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. [phone]

[Thomas Cameron]

This may be helpful:

Security-Enhanced Linux for mere mortals

https://www.youtube.com/watch?v=_WOKRaM-HI4

I gave this presentation at Red Hat Summit a couple of years ago, it's 
still relevant. I talk about how to enable SELinux on a system where 
it's been disabled.

Hope this helps!

Thomas

On 8/16/21 9:53 AM, François Patte wrote:
> Bonjour,
>
> For some reason (I explain later) I disabled selinux in 
> /etc/selinux/config file.
>
> When I re-enabled selinux (SELINUX=enforcing in the config file) I 
> could not restart my system: no service could start and I got a kernel 
> panic.
>
> I had to rescue my system (see my other post) and disabled selinux.
>
> Why??? I remember that long ago, when you enabled selinux boot could 
> last a long time waiting for the indexation of files, but I have never 
> seen a kernel panic.
>
> So, how do I proceed to re-enable selinux on my system?
>
> Thank you.
>
> PS. I disabled selinux because it prevented to start a service (dictd, 
> see my post) but it was a wrong message of selinux alert: the problem 
> was not selinux but the upgrade from f32 to f34 which had changed the 
> owner of the dictd.log file (dictd changed to root).
>
> This is a second wrong message with the one of the rescue tool (see my 
> post on rescue)
>

[François Patte]

Le 2021-08-16 17:35, Thomas Cameron a écrit :
>  This may be helpful:
>  
>  Security-Enhanced Linux for mere mortals
>  
>  https://www.youtube.com/watch?v=_WOKRaM-HI4
>  
>  I gave this presentation at Red Hat Summit a couple of years ago, it's
>  still relevant. I talk about how to enable SELinux on a system where
>  it's been disabled.
>  
>  Hope this helps!
>   
Thank you for answering. This video is going a little bit to fast for 
me: if I can read and speak English, it is easier for me if people speak 
a bit slower...

Anyway, as far as I understand, if I want to re-enable selinux I have 
to:

1- change the config file to enforcing
2- touch /.autorelabel
3- reboot

Did I miss something?


-- 
François Patte
UFR de mathématiques et informatique
Laboratoire CNRS MAP5, UMR 8145
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. [phone]

[Thomas Cameron]

Thank you for answering. This video is going a little bit to fast for 
me: if I can read and speak English, it is easier for me if people speak 
a bit slower...
>  Anyway, as far as I understand, if I want to re-enable selinux I have to:
>
>  1- change the config file to enforcing
>  2- touch /.autorelabel
>  3- reboot
>
>  Did I miss something?
>
>  
Yes, that will work.

[Thomas Cameron]

I apologize, I will try to speak more slowly and clearly for future 
presentations.

Thomas

On 8/16/2021 6:25 PM, Thomas Cameron wrote:
> Thank you for answering. This video is going a little bit to fast for 
> me: if I can read and speak English, it is easier for me if people 
> speak a bit slower...
>>
>> Anyway, as far as I understand, if I want to re-enable selinux I have 
>> to:
>>
>> 1- change the config file to enforcing
>> 2- touch /.autorelabel
>> 3- reboot
>>
>> Did I miss something?
>>
>>
>
> Yes, that will work.
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: 
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam on the list, report it: 
> https://pagure.io/fedora-infrastructure

[François Patte]

Le 2021-08-17 01:25, Thomas Cameron a écrit :
>  Thank you for answering. This video is going a little bit to fast
> for
>  me: if I can read and speak English, it is easier for me if people
>  speak a bit slower...
> > 
> > Anyway, as far as I understand, if I want to re-enable selinux I have 
> > to:
> > 
> > 1- change the config file to enforcing
> > 2- touch /.autorelabel
> > 3- reboot
> > 
> > Did I miss something?
> > 
> > 
>  
>  Yes, that will work. 
It seems that the sequence should be:

1- touch /.autorelabel
2- reboot
3- change the config file to enforcing
4- reboot


-- 
François Patte
UFR de mathématiques et informatique
Laboratoire CNRS MAP5, UMR 8145
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. [phone]

[Doug H.]

On Mon, Aug 16, 2021, at 7:53 AM, François Patte wrote:
>  Bonjour,
>  
>  For some reason (I explain later) I disabled selinux in 
>  /etc/selinux/config file.
>  
>  When I re-enabled selinux (SELINUX=enforcing in the config file) I could 
>  not restart my system: no service could start and I got a kernel panic. 

Thomas has pointed to something to help get it fixed, but I wanted to make sure that
people know that you should not disable it if you might later want to re-enable it. It is
safer to set it to permissive instead. This allows you to run things that were being
blocked but it lets selinux keep up to date and is less likely to end up with the sort of
issue that you are having.



-- 
Doug Herr
fedoraproject.org(a)wombatz.com

[C Linus Hicks]

On Mon, 2021-08-16 at 08:50 -0700, Doug H. wrote:
>  On Mon, Aug 16, 2021, at 7:53 AM, François Patte wrote:
>  > Bonjour,
>  > 
>  > For some reason (I explain later) I disabled selinux in 
>  > /etc/selinux/config file.
>  > 
>  > When I re-enabled selinux (SELINUX=enforcing in the config file) I could 
>  > not restart my system: no service could start and I got a kernel panic.
>  
>  Thomas has pointed to something to help get it fixed, but I wanted to make sure that
> people know that you should not disable it if you might later want to re-enable it. It is
> safer to set it to permissive instead. This allows you to run things that were being
> blocked but it lets selinux keep up to date and is less likely to end up with the sort of
> issue that you are having.
>   
See the setenforce and getenforce commands.