主页
产品
Red Hat Enterprise Linux
10
Using SELinux
6.3. Switching the SELinux policy to MLS

6.3. Switching the SELinux policy to MLS

Use the following steps to switch the SELinux policy from targeted to Multi-Level Security (MLS).

重要

Do not use the MLS policy on a system that is running the X Window System. Furthermore, when you relabel the file system with MLS labels, the system may prevent confined domains from access, which prevents your system from starting correctly. Therefore ensure that you switch SELinux to permissive mode before you relabel the files. On most systems, you see a lot of SELinux denials after switching to MLS, and many of them are not trivial to fix.

Procedure

Install the selinux-policy-mls package:
```
# dnf install selinux-policy-mls
```
Open the /etc/selinux/config file in a text editor of your choice, for example:
```
# vi /etc/selinux/config
```
Change SELinux mode from enforcing to permissive and switch from the targeted policy to MLS:
```
SELINUX=permissive
SELINUXTYPE=mls
```
Save the changes, and quit the editor.
Before you enable the MLS policy, you must relabel each file on the file system with an MLS label:
```
# fixfiles -F onboot
System will relabel on next boot
```
Restart the system:
```
# reboot
```
Check for SELinux denials:
```
# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i
```
Because the previous command does not cover all scenarios, see Troubleshooting problems related to SELinux for guidance on identifying, analyzing, and fixing SELinux denials.
After you ensure that there are no problems related to SELinux on your system, switch SELinux back to enforcing mode by changing the corresponding option in /etc/selinux/config:
```
SELINUX=enforcing
```
Restart the system:
```
# reboot
```

重要

If your system does not start or you are not able to log in after you switch to MLS, add the enforcing=0 parameter to your kernel command line. See Changing SELinux modes at boot time for more information.

Also note that in MLS, SSH logins as the root user mapped to the sysadm_r SELinux role differ from logging in as root in staff_r. Before you start your system in MLS for the first time, consider allowing SSH logins as sysadm_r by setting the ssh_sysadm_login SELinux boolean to 1. To enable ssh_sysadm_login later, already in MLS, you must log in as root in staff_r, switch to root in sysadm_r using the newrole -r sysadm_r command, and then set the boolean to 1.

Verification

Verify that SELinux runs in enforcing mode:
```
# getenforce
Enforcing
```

Check that the status of SELinux returns the mls value:

# sestatus | grep mls
Loaded policy name:             mls

6.3. Switching the SELinux policy to MLS

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links