Re: [PATCH] selinux(8): note on conflicting configurations

Johannes Segitz <[email protected]> writes:

> setting SELINUX=disabled while having selinux=1
> results in a non-booting system. Document this
> here in a note
>
> Signed-off-by: Johannes Segitz <[email protected]>
> ---
>  libselinux/man/man8/selinux.8 | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8
> index 5842150b..17df2a99 100644
> --- a/libselinux/man/man8/selinux.8
> +++ b/libselinux/man/man8/selinux.8
> @@ -50,6 +50,15 @@ regardless of what is set in the
>  .I /etc/selinux/config
>  file.
>
> +.B NOTE:
> +When setting a conflicting configuration like
> +.B SELINUX=disabled
> +in
> +.I /etc/selinux/config
> +while having
> +.B selinux=1
> +on the kernel boot options will result in a non-bootable system.
> +
>  The
>  .I /etc/selinux/config
>  configuration file also controls what policy
> --
> 2.55.0

It seems to work for me on CentOS Stream 10:

[root@default-0]# sestatus 
SELinux status:                 disabled

[root@default-0]# cat /proc/cmdline 
BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.12.0-250.el10.x86_64 root=UUID=45db8c52-819d-4199-bca1-3f50a95d7fc5 ro console=ttyS0,115200n8 no_timer_check crashkernel=2G-64G:256M,64G-:512M selinux=1

[root@default-0]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
# See also:
# https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/#getting-started-with-selinux-selinux-states-and-modes
#
# NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
#    grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
#    grubby --update-kernel ALL --remove-args selinux
#
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted


[root@default-0]# rpm -q libselinux
libselinux-3.11-1.el10.x86_64