I have installed SELinux on Ubuntu 18.04.1 LTS via

# apt install selinux

After the mandatory reboot, SELinux was constantly disabled until I added

SELinux = 1 to /etc/default/grub

and executed sudo update-grub

upon which SELinux seems to be working correctly.

sestatus reports back with

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             default
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     requested (insecure)
Max kernel policy version:      31

However, executing

# sudo systemctl status selinux 


Nov 21 14:38:51 ubuntu-selinux systemd[1]: 
Started LSB: Relabel the filesystem before reboot.

even though I have relabeled the file-system by adding touch /.autorelabel and also executing sudo fixfiles relabel and rebooting the system afterwards.

Additional information that may be relevant

  • apparmor was successfully removed
  • filesystem is ext4
  • This is a fresh install, so nothing else was tinkered with.

My question(s): Why did I have to add the kernel parameter manually and why is SELinux prompting me for another relabel on every boot?

  • 1
    Ubuntu does not fully support selinux policy so you have to write your own. If you want selinux use fedora / RHEL / Centos – Panther Nov 21 '18 at 15:51

Don't install the selinux package, install selinux-basic instead.

The selinux package is ubuntu specific and is really old and not working well with systemd.

To be honest I thought it was already removed from the ubuntu archive for a while.

| improve this answer | |

You had to manually add the kernel parameters because Ubuntu uses AppArmor by default and it's kinda rare to see SELinux used on ubuntu systems. That might actually be considered a bug, and you might want to consider opening a launchpad bug report for the selinux package.

Regarding the constant relabeling: does the /.autorelabel file still exist after a reboot ? On CentOS/RHEL one of the systemd units removes it AFAIK, but this might not happen on Ubuntu I guess.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.