Re: selinux causing problems

[Tixy]

On Tue, 2023-10-31 at 18:36 +1300, Alex King wrote:
> Now it seems that selinux is active again, and even when I try to set 
> selinux=0 to disable it, it is still running and spamming the logs with 
> messages like
> 
> logrotate.service: Failed to read SELinux context of 
> '/lib/systemd/system/logrotate.service', ignoring: Operation not permitted
> 
> 
> How should I disable selinux?

I'm guessing here, but perhaps selinux _is_ disabled but things are
still trying to use it and producing error messages. Have you tried
uninstalled the 'apparmour' package? I remember doing this in years
past when it first started getting installed and putting noise on boot
screen and in logs.

-- 
Tixy

selinux causing problems

[Alex King]

Does anyone know how to disable selinux?

I had selinux installed on this system a long time ago.  Recently I 
believe apparmor was active (and therefore selinux not active).  Today I 
upgraded to Debian 12.


apparmor was preventing named (bind9) from running; whatever I did, it 
was denying read to a file (/usr/share/dns/root.hints).  So I disabled 
apparmor by setting apparmor=0 on the boot command line.


Now it seems that selinux is active again, and even when I try to set 
selinux=0 to disable it, it is still running and spamming the logs with 
messages like


logrotate.service: Failed to read SELinux context of 
'/lib/systemd/system/logrotate.service', ignoring: Operation not permitted



How should I disable selinux?  I followed the suggestion in the man page 
(man selinux: To properly disable SELinux, it is recommended to use the 
selinux=0 kernel boot option).  This does not seem to work.


Any help greatly appreciated.

Thanks,
Alex


# lsb_release  -a
No LSB modules are available.
Distributor ID: Debian
Description:Debian GNU/Linux 12 (bookworm)
Release:12
Codename:   bookworm

# cat /proc/version
Linux version 6.1.0-13-686-pae (debian-ker...@lists.debian.org) (gcc-12 
(Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP 
PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29)


# cat /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-6.1.0-13-686-pae root=/dev/mapper/main-root ro 
quiet apparmor=0 selinux=0


# sestatus
SELinux status: enabled
SELinuxfs mount:/sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode:   permissive
Mode from config file:  disabled
Policy MLS status:  disabled
Policy deny_unknown status: denied
Memory protection checking: actual (secure)
Max kernel policy version:  33