Bug 1368478

Summary: setsebool and getsebool should change config even if selinux is disabled
Product: Red Hat Enterprise Linux 7 Reporter: Raghavendra Talur <rtalur>
Component: policycoreutilsAssignee: Petr Lautrbach <plautrba>
Status: CLOSED NOTABUG QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4CC: dwalsh, lvrabec, mgrepl, mmalik, plautrba, ssekidde
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-05 08:07:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Raghavendra Talur 2016-08-19 14:06:22 UTC 
Description of problem:

I have a setup where selinux has been disabled. I install some packages which perform setsebool as part of the %post section in rpm. This setsebool fails as selinux is disabled. When I enable selinux on a later date and restorecon on the all the directories, I would not get the sebool set.

If the setsebool command worked(by worked I mean updating a policy file or some config file) even if selinux was disabled, it would be a one step process for me to enable seliux on a later date.


How reproducible:
Always


Steps to Reproduce:
1. Disable selinux by editing /etc/sysconfig/selinux and reboot
2. setsebool -P samba_load_libgfapi=1 (errors out)
3. enable selinux by editing /etc/sysconfig/selinux and reboot
4. semanage boolean -l | grep samba_load_libgfapi 


Actual results:
No change in the bool value by step 2

Expected results:
setsebool should change the config immediately, only whether it comes into effect or not should be dependent on selinux status. 



I understand that there might be technical limitations to achieve what has been asked here. If that is the case please provide explanation for the same and also workarounds for packages to be able to set sebools in such situations to make it easier for end-user.
Comment 2 Daniel Walsh 2016-08-19 19:46:19 UTC 
semanage boolean, I believe will work with SELinux disabled.
Comment 3 Petr Lautrbach 2016-09-05 08:07:04 UTC 
(In reply to Daniel Walsh from comment #2)
> semanage boolean, I believe will work with SELinux disabled.


This is correct:

$ sudo  sestatus 
SELinux status:                 disabled

$ sudo semanage boolean -N -S targeted -m --on samba_load_libgfapi

$ sudo cat /etc/selinux/targeted/active/booleans.local      
# This file is auto-generated by libsemanage
# Do not edit directly.

samba_load_libgfapi=1

$