Red Hat Bugzilla – Bug 1258569
anaconda interprets 'selinux=0' parameter incorrectly
Last modified: 2015-11-02 10:37:37 EST
Description of problem: selinux directive on the commandline and in kickstart file is not honoured. Version-Release number of selected component (if applicable): 23_Beta_TC1 Server Product How reproducible: Everytime Steps to Reproduce: 1. Prepare a kickstart file with a line 'selinux --disabled'. 2. Boot using kickstart file and selinux=0 on the commandline and install the system 3. On the installed system inspect /etc/selinux/config file and see that the policy is enforcing. Actual results: SElinux policy is enforcing Expected results: SElinux policy is disabled Additional info:
This is a blocker by the Alpha criterion: SELinux configuration Unless explicitly specified otherwise, after system installation SELinux must be enabled and in enforcing mode. As selinux is not changed if explicitly specified otherwise.
The problem is that selinux=0 is being interpreted as the same as a bare "selinux", i.e., enable selinux. It's also worth noting that this is not new behavior.
How would you disable selinux from the command line then? But anyhowe also the selinux --disable line in a kickstart file does not disable selinux.
Command line overrides kickstart. On the command line you can use noselinux.
A.J.: can you confirm that just using the kickstart and not the CLI parameter works? And that using the correct CLI parameter also works? Thanks.
Discussed at 2015-09-14 blocker review meeting: https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2015-09-14/f23-blocker-review.2015-09-14-16.00.log.txt . Rejected as a blocker: it seems clear that the only thing here that's really a 'bug' is that anaconda doesn't interpret 'selinux=0' as expected, which is unfortunate but we agreed does not violate the criterion. FWIW the criterion was actually only intended to require that in a 'normal' install, SELinux must be enabled. It wasn't intended to require that it be possible to disable SELinux via the installer, though I admit the wording turned out somewhat ambiguous. In any case, it seems clear that it *is* certainly possible to disable via the installer, A.J. just ran into an unfortunate corner case.
Kickstart works without the CLI parameter. Using noselinux parameter on the commandline also works.
OK, so updating the description. Thanks!
https://github.com/rhinstaller/anaconda/pull/413