Bug 2039968 - anaconda writes "selinux=0" to /etc/default/grub on live installs
Summary: anaconda writes "selinux=0" to /etc/default/grub on live installs
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: anaconda
Version: rawhide
Hardware: All
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Anaconda Maintenance Team
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: openqa
Depends On:
Blocks: F36BetaBlocker
TreeView+ depends on / blocked
 
Reported: 2022-01-12 19:42 UTC by Adam Williamson
Modified: 2022-02-05 00:48 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-02-05 00:48:21 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Adam Williamson 2022-01-12 19:42:18 UTC
In recent Rawhide composes, it seems that anaconda is adding "selinux=0" to the GRUB_CMDLINE_LINUX line in /etc/default/grub on live installs, so it reads:

GRUB_CMDLINUX_LINUX="rhgb quiet selinux=0"

this obviously results in the system having SELinux disabled, which is definitely not what we want.

This only seems to happen on live installs (at least, on a quick check - the openQA base_selinux test is failing on live image installs, but passing on the server DVD install and the Silverblue dvd_ostree install). I'm not sure what changed exactly, yet.

This is a violation of Basic release criterion "Unless explicitly specified otherwise, after system installation SELinux must be enabled and in enforcing mode" - https://fedoraproject.org/wiki/Basic_Release_Criteria#selinux-configuration - so proposing as a Beta blocker.

Comment 1 Adam Williamson 2022-01-13 19:01:19 UTC
https://github.com/rhinstaller/anaconda/commit/b11de43acca8ccca410557ac7513e99076d94234 inadvertently flipped the logic of a check in liveinst that's supposed to add `--noselinux` to the anaconda command line if SELinux is disabled; now it adds `--noselinux` if it's enabled. https://github.com/rhinstaller/anaconda/pull/3779 should fix it.

Comment 2 Vladimír Slávik 2022-01-17 15:28:09 UTC
PR merged, waiting for release.

Comment 3 Adam Williamson 2022-02-05 00:48:21 UTC
This is confirmed fixed, the openQA test passes in current composes.


Note You need to log in before you can comment on or make changes to this bug.