1

I have installed SELinux on Ubuntu 18.04.1 LTS via

# apt install selinux

After the mandatory reboot, SELinux was constantly disabled until I added

SELinux = 1 to /etc/default/grub

and executed sudo update-grub

upon which SELinux seems to be working correctly.

sestatus reports back with

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             default
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     requested (insecure)
Max kernel policy version:      31

However, executing

# sudo systemctl status selinux 

yields

Nov 21 14:38:51 ubuntu-selinux systemd[1]: 
Started LSB: Relabel the filesystem before reboot.

even though I have relabeled the file-system by adding touch /.autorelabel and also executing sudo fixfiles relabel and rebooting the system afterwards.

Additional information that may be relevant

  • apparmor was successfully removed
  • filesystem is ext4
  • This is a fresh install, so nothing else was tinkered with.

My question(s): Why did I have to add the kernel parameter manually and why is SELinux prompting me for another relabel on every boot?

1
  • 1
    Ubuntu does not fully support selinux policy so you have to write your own. If you want selinux use fedora / RHEL / Centos
    – Panther
    Nov 21, 2018 at 15:51

2 Answers 2

0

Don't install the selinux package, install selinux-basic instead.

The selinux package is ubuntu specific and is really old and not working well with systemd.

To be honest I thought it was already removed from the ubuntu archive for a while.

0

You had to manually add the kernel parameters because Ubuntu uses AppArmor by default and it's kinda rare to see SELinux used on ubuntu systems. That might actually be considered a bug, and you might want to consider opening a launchpad bug report for the selinux package.

Regarding the constant relabeling: does the /.autorelabel file still exist after a reboot ? On CentOS/RHEL one of the systemd units removes it AFAIK, but this might not happen on Ubuntu I guess.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .