hank-test/quick-docs
1
0
Fork 0
mirror of https://pagure.io/fedora-docs/quick-docs.git synced 2024-10-19 01:35:42 +00:00
Code Issues 1 Projects Releases Packages Wiki Activity Actions

Clarify enabling/disabling procedures for SELinux

Browse source 
* Simplify list of required packages (and add `grubby`).
* Move Disabled -> Enforcing steps from `changing-to-enforcing-mode` to
  `enabling-selinux`.
* In `changing-to-enforcing-mode`, use the correct procedure based on
  whether SELinux is currently Permissive or Disabled.
* Add step for ensuring that filesystem is relabeled when re-enabling
  SELinux.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This commit is contained in:
Ondrej Mosnacek 2020-10-30 14:47:18 +01:00 committed by pbokoc
parent 65925232d5
commit db3dc1ca8b
2 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
modules/ROOT/pages/_partials/proc_changing-to-enforcing-mode.adoc
View file

@ -7,13 +7,7 @@
When SELinux is running in enforcing mode, it enforces the SELinux policy and denies access based on SELinux policy rules. In Fedora, enforcing mode is enabled by default when the system was initially installed with SELinux. When SELinux is running in enforcing mode, it enforces the SELinux policy and denies access based on SELinux policy rules. In Fedora, enforcing mode is enabled by default when the system was initially installed with SELinux.
If SELinux was disabled, follow the procedure below to change mode to enforcing again: First check the current SELinux mode by running the [command]`getenforce` command. If it displays `Disabled`, then follow <<{context}-enabling-selinux>>. Otherwise, if it displays `Permissive`, follow the procedure below to change mode to enforcing again:
This procedure assumes that the [package]*selinux-policy-targeted*, [package]*selinux-policy*, [package]*libselinux*, [package]*libselinux-python*, [package]*libselinux-utils*, [package]*policycoreutils*, and [package]*policycoreutils-python* packages are installed. To verify that the packages are installed, use the following command:
[subs="quotes"]
----
~]$ rpm -q _package_name_
----
. Edit the `/etc/selinux/config` file as follows: . Edit the `/etc/selinux/config` file as follows:
+ +

12
modules/ROOT/pages/_partials/proc_enabling-selinux.adoc
View file

@ -9,6 +9,12 @@ When enabled, SELinux can run in one of two modes: enforcing or permissive. The
While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, follow this procedure: While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, follow this procedure:
This procedure assumes that the [package]*selinux-policy-targeted*, [package]*selinux-policy*, [package]*libselinux-utils*, and [package]*grubby* packages are installed. To verify that the packages are installed, use the following command:
[subs="quotes"]
----
~]$ rpm -q _package_name_
----
. In case your system has SELinux disabled at the kernel level (this is the recommended way, see <<{context}-disabling-selinux>>), make sure to undo that first. . In case your system has SELinux disabled at the kernel level (this is the recommended way, see <<{context}-disabling-selinux>>), make sure to undo that first.
.. Check if you have `selinux=0` in your kernel command line: .. Check if you have `selinux=0` in your kernel command line:
@ -27,6 +33,12 @@ _[...]_ rd.lvm.lv=fedora/swap rhgb quiet *selinux=0*
.. The change will be applied after you reboot the system (see below). .. The change will be applied after you reboot the system (see below).
. Ensure the filesystem is relabeled on next boot:
+
----
~]# fixfiles onboot
----
. Enable SELinux in permissive mode. For more information, see <<{context}-changing-to-permissive-mode>>. . Enable SELinux in permissive mode. For more information, see <<{context}-changing-to-permissive-mode>>.
. Reboot your system. . Reboot your system.