Description of problem: This is a continuation of BZ #1843870. Switching the system from Targeted to MLS by editing /etc/selinux/config, executing "fixfiles -B onboot" and booting with "enforcing=0" doesn't apply the policy correctly. During relabeling, we see a lot of invalid labels (for MLS policy point of view) being untouched: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [ 9.461243] SELinux: Context system_u:object_r:rhsmcertd_config_t:s0 is not valid (left unmapped). [ 9.467703] SELinux: Context system_u:object_r:fwupd_cert_t:s0 is not valid (left unmapped). [ 9.480796] SELinux: Context unconfined_u:object_r:system_conf_t:s0 is not valid (left unmapped). [ 9.498028] SELinux: Context system_u:object_r:rhnsd_conf_t:s0 is not valid (left unmapped). [ 9.514821] SELinux: Context unconfined_u:object_r:file_context_t:s0 is not valid (left unmapped). ... -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- After relabeling and boot with "enforcing=0" again (otherwise system isn't usable), "restorecon -Frnv /" command shows tons of files that have not been relabeled: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # restorecon -Frvn / > restorecon.out # grep "exec_t" restorecon.out [...] Would relabel /usr/sbin/rasdaemon from system_u:object_r:rasdaemon_exec_t:s0 to system_u:object_r:bin_t:s0 Would relabel /usr/sbin/kpatch from system_u:object_r:kpatch_exec_t:s0 to system_u:object_r:bin_t:s0 Would relabel /usr/sbin/spice-vdagentd from system_u:object_r:vdagent_exec_t:s0 to system_u:object_r:bin_t:s0 Would relabel /usr/sbin/blkmapd from system_u:object_r:blkmapd_exec_t:s0 to system_u:object_r:bin_t:s0 Would relabel /usr/lib/realmd/realmd from system_u:object_r:realmd_exec_t:s0 to system_u:object_r:lib_t:s0 [...] -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Hence, to apply the MLS policy, the admin must apply "restorecon -Frv /" on the system while booting in Permissive mode. Version-Release number of selected component (if applicable): policycoreutils-2.9-9.el8.x86_64 How reproducible: Always Steps to Reproduce: 1. Install selinux-policy-mls package 2. Edit /etc/selinux/config and move to "mls" 3. Edit /etc/selinux/config and change to Permissive 4. Execute "fixfiles -B onboot" 5. Reboot
(In reply to Renaud Métrich from comment #0) > 4. Execute "fixfiles -B onboot" You should execute: # fixfiles -F onboot
Sorry, possible I made typos while reproducing. But this also reproduces with a "touch /.autorelabel" and reboot. I will double check anyway
I can confirm this doesn't change anything at all.
"touch /.autorelabel" would not help, you need to push -F inside the file: "fixfiles -F onboot" is equivalent to "echo -n '-F ' > /.autorelabel"
Indeed "fixfiles -F onboot" helps here.