홈
제품
Red Hat Enterprise Linux
10
Using SELinux
2.4. Enabling SELinux on systems that previously had it disabled

2.4. Enabling SELinux on systems that previously had it disabled

To prevent problems, such as systems unable to boot or process failures, resolve Access Vector Cache (AVC) messages in permissive mode before enabling SELinux on systems that previously had it disabled.

When systems run SELinux in permissive mode, users and processes might label various file-system objects incorrectly. File-system objects created while SELinux is disabled are not labeled at all. This behavior causes problems when changing to enforcing mode because SELinux relies on correct labels of file-system objects.

To prevent incorrectly labeled and unlabeled files from causing problems, SELinux automatically relabels file systems when changing from the disabled state to permissive or enforcing mode.

주의

Before rebooting the system for relabeling, make sure the system will boot in permissive mode, for example by using the enforcing=0 kernel option. This prevents the system from failing to boot in case the system contains unlabeled files required by systemd before launching the selinux-autorelabel service. For more information, see RHBZ#2021835.

Procedure

Enable SELinux in permissive mode. For more information, see Changing SELinux to permissive mode.
Restart your system:
```
# reboot
```
Check for SELinux denial messages. For more information, see Identifying SELinux denials.
Ensure that files are relabeled upon the next reboot:
```
# fixfiles -F onboot
```
This creates the /.autorelabel file containing the -F option.
주의
Always switch to permissive mode before entering the fixfiles -F onboot command.
By default, autorelabel uses as many threads in parallel as the system has available CPU cores. To use only a single thread during automatic relabeling, use the fixfiles -T 1 onboot command.
If there are no denials, switch to enforcing mode. For more information, see Changing SELinux modes at boot time.

Verification

After the system restarts, confirm that the getenforce command returns Enforcing:
```
$ getenforce
Enforcing
```

Next steps

To run custom applications with SELinux in enforcing mode, choose one of the following scenarios:

Run your application in the unconfined_service_t domain.
Write a new policy for your application. See the Writing a custom SELinux policy section for more information.

2.4. Enabling SELinux on systems that previously had it disabled

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links