SELinux demands constant relabeling

Question

I have installed SELinux on Ubuntu 18.04.1 LTS via

# apt install selinux

After the mandatory reboot, SELinux was constantly disabled until I added

SELinux = 1 to /etc/default/grub

and executed sudo update-grub

upon which SELinux seems to be working correctly.

sestatus reports back with

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             default
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     requested (insecure)
Max kernel policy version:      31

However, executing

# sudo systemctl status selinux 

yields

Nov 21 14:38:51 ubuntu-selinux systemd[1]: 
Started LSB: Relabel the filesystem before reboot.

even though I have relabeled the file-system by adding touch /.autorelabel and also executing sudo fixfiles relabel and rebooting the system afterwards.

Additional information that may be relevant

• apparmor was successfully removed
• filesystem is ext4
• This is a fresh install, so nothing else was tinkered with.

My question(s): Why did I have to add the kernel parameter manually and why is SELinux prompting me for another relabel on every boot?

Answer 1

Don't install the selinux package, install selinux-basic instead.

The selinux package is ubuntu specific and is really old and not working well with systemd.

To be honest I thought it was already removed from the ubuntu archive for a while.

Answer 2

You had to manually add the kernel parameters because Ubuntu uses AppArmor by default and it's kinda rare to see SELinux used on ubuntu systems. That might actually be considered a bug, and you might want to consider opening a launchpad bug report for the selinux package.

Regarding the constant relabeling: does the /.autorelabel file still exist after a reboot ? On CentOS/RHEL one of the systemd units removes it AFAIK, but this might not happen on Ubuntu I guess.