System does not start when SELinux is disabled

Last Updated : Nov 25, 2021 |
Prolog information
Metadata
Keywords:

Condition

The system hangs when rebooted if SELinux is disabled.

Cause

Due to PCI recommendations, SELinux is activated at the system boot loader time. This must match the expected SELinux command file.
Note:
Avaya does not recommend disabling SELinux as doing so can lower its security and remove it from PCI compliance. However, if required, use the following procedure to ensure the system reboots without stopping.

Solution

  1. To disable SELinux, do the following:
    1. Run the following commands as root on a command line:
      ADDITIONAL INFORMATION: grubby --update-kernel=ALL --remove-args="selinux=1" --args="selinux=0"
      grubby --update-kernel=ALL --remove-args="enforcing=1" --args="enforcing=0"
      sed -i '/^SELINUX=/ s/\(enforcing\|permissive\)/disabled/' /etc/selinux/config
      reboot
    2. Log back in and test the status by running the sestatus command.
      ADDITIONAL INFORMATION: # sestatus
      SELinux status:                 disabled
  2. To enable SELinux, do the following:
    1. Run the following commands as root on a command line:
      ADDITIONAL INFORMATION: grubby --update-kernel=ALL --remove-args="selinux=0" --args="selinux=1"
      grubby --update-kernel=ALL --remove-args="enforcing=0" --args="enforcing=1"
      sed -i '/^SELINUX=/ s/\(disabled\|permissive\)/enforcing/' /etc/selinux/config
      reboot
      STEP RESULT:
      This may take a while to re-label the files on the disk. The system automatically reboots when done.
    2. Log back in and test the status by running the sestatus command.
      ADDITIONAL INFORMATION: # sestatus
      SELinux status:                 enabled
      Loaded policy name:             targeted
      Current mode:                   enforcing
  3. To set SELinux to permissive, do the following:
    1. Run the following commands as root on a command line:
      ADDITIONAL INFORMATION: grubby --update-kernel=ALL --remove-args="selinux=0" --args="selinux=1"
      grubby --update-kernel=ALL --remove-args="enforcing=1" --args="enforcing=0"
      sed -i '/^SELINUX=/ s/\(disabled\|enforcing\)/permissive/' /etc/selinux/config
      reboot
      STEP RESULT:
      This may take a while to re-label the files on the disk. The system automatically reboots when done.
    2. Log back in and test the status by running the sestatus command.
      ADDITIONAL INFORMATION: # sestatus
      SELinux status:                 enabled
      Loaded policy name:             targeted
      Current mode:                   permissive