Return
-
Title
SELINUX enforcing mode disabled and enabled again -
Description
A system that had SELinux enforcing and at any point it is put in permissive or disabled state, then returned to enforcing will "vastool configure selinux" needs to run again?
-
Cause
When the system runs SELinux in permissive mode, users are able to label files incorrectly.Files created with SELinux in permissive mode are not labeled correctly while files created while SELinux is disabled are not labeled at all.This behavior causes problems when changing to enforcing mode because files are labeled incorrectly or are not labeled at all.To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from the disabled state to permissive or enforcing mode. -
Resolution
In order to make sure Authentication Services processes run in the proper SELinux context and to correct any entries that may have changed between permissive/disabled and enforcing mode, please always run
# vastool configure selinux
After you switch to enforcing mode.