이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 8. Enabling SELinux

After upgrading to Red Hat Gluster Storage 3.x, follow the steps mentioned here for SELinux support. These steps are not mandatory and are required only if SELinux support is required.

This procedure assumes that the selinux-policy-targeted, selinux-policy, libselinux, libselinux-python provided by the python3-libselinux package in Red Hat Enterprise Linux 8 (RHEL 8), libselinux-utils, policycoreutils, policycoreutils-python replaced by the policycoreutils-python-utils and python3-policycoreutils packages in RHEL8, setroubleshoot, setroubleshoot-server, setroubleshoot-plugins packages are installed. To verify that the packages are installed, use the following command:

rpm -q package_name

# rpm -q package_name

Copy to Clipboard

Toggle word wrap

Important

If the system was initially installed without SELinux, particularly the selinux-policy package, one additional step is necessary to enable SELinux. To make sure SELinux is initialized during system startup, the dracut utility has to be run to put SELinux awareness into the initramfs file system. Failing to do so causes SELinux to not start during system startup.

Before SELinux is enabled, each file on the file system must be labeled with an SELinux context. Before this happens, confined domains may be denied access, preventing your system from booting correctly. To prevent this, configure SELINUX=permissive in /etc/selinux/config:

This file controls the state of SELinux on the system.
SELINUX= can take one of these three values:
      enforcing - SELinux security policy is enforced.
      permissive - SELinux prints warnings instead of enforcing.
      disabled - No SELinux policy is loaded.
SELINUXTYPE= can take one of these two values:
      targeted - Targeted processes are protected,
      mls - Multi Level Security protection

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#       targeted - Targeted processes are protected,
#       mls - Multi Level Security protection
SELINUXTYPE=targeted

Copy to Clipboard

Toggle word wrap

As the Linux root user, reboot the system. During the next boot, file systems are labeled. The label process labels each file with an SELinux context:
```
*** Warning -- SELinux targeted policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
****
```
```
*** Warning -- SELinux targeted policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
****
```
Copy to Clipboard Toggle word wrap
Each * (asterisk) character on the bottom line represents 1000 files that have been labeled. In the above example, four * characters represent 4000 files have been labeled. The time it takes to label all files depends on the number of files on the system and the speed of hard drives. On modern systems, this process can take as short as 10 minutes.
In permissive mode, the SELinux policy is not enforced, but denial messages are still logged for actions that would have been denied in enforcing mode. Before changing to enforcing mode, as the Linux root user, run the following command to confirm that SELinux did not deny actions during the last boot:
```
grep "SELinux is preventing" /var/log/messages
```
```
# grep "SELinux is preventing" /var/log/messages
```
Copy to Clipboard Toggle word wrap
If SELinux did not deny any actions during the last boot, this command returns no output.

If there were no denial messages in /var/log/messages, configure SELINUX=enforcing in /etc/selinux/config:

This file controls the state of SELinux on the system.
SELINUX= can take one of these three values:
      enforcing - SELinux security policy is enforced.
      permissive - SELinux prints warnings instead of enforcing.
      disabled - No SELinux policy is loaded.
SELINUXTYPE= can take one of these two values:
      targeted - Targeted processes are protected,
      mls - Multi Level Security protection.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#       targeted - Targeted processes are protected,
#       mls - Multi Level Security protection.
SELINUXTYPE=targeted

Copy to Clipboard

Toggle word wrap

Reboot your system. After reboot, confirm that getenforce returns Enforcing
```
getenforce
```
```
~]$ getenforce
Enforcing
```
Copy to Clipboard Toggle word wrap

For more information on changing SELINUX states and modes in REHL 7, refer to Permanent Changes in SELINUX States and Modes in the SELinux User's and Adminstrator's Guide

For more information on changing SELINUX states and modes in REHL 8, refer to Permanent Changes in SELINUX States and Modes in the Using SELinux

맨 위로 이동

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 8. Enabling SELinux

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links