I have installed SELinux on Ubuntu 18.04.1 LTS via
# apt install selinux
After the mandatory reboot, SELinux was constantly disabled until I added
SELinux = 1
to /etc/default/grub
and executed
sudo update-grub
upon which SELinux seems to be working correctly.
sestatus
reports back with
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: permissive
Mode from config file: permissive
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: requested (insecure)
Max kernel policy version: 31
However, executing
# sudo systemctl status selinux
yields
Nov 21 14:38:51 ubuntu-selinux systemd[1]:
Started LSB: Relabel the filesystem before reboot.
even though I have relabeled the file-system by adding touch /.autorelabel
and also executing sudo fixfiles relabel
and rebooting the system afterwards.
Additional information that may be relevant
- apparmor was successfully removed
- filesystem is
ext4
- This is a fresh install, so nothing else was tinkered with.
My question(s): Why did I have to add the kernel parameter manually and why is SELinux prompting me for another relabel on every boot?