Fedora 9 and selinux

[Craig White]

On Sun, 2008-05-25 at 22:21 -0500, Daniel Auger wrote:
> On Sun, May 25, 2008 at 8:58 PM, Patrick O'Callaghan
> <pocallaghan at gmail.com> wrote:
> > On Sun, 2008-05-25 at 17:45 -0500, Chris S. Wilson wrote:
> >> Not sure, But I do know SElinux is a great thing to have enabled - its just
> >> a major pain in the a** :=]
> >>
> >> You can edit /etc/selinux/config to enable/disable selinux (maybe that's why
> >> it was taken out, its just so simple :)), and just reboot. man selinux for
> >> more information.
> >
> > *Please* don't top-post.
> >
> > You can run system-config-selinux to select whether you want enforcing,
> > permissive or off modes.
> >
> > poc
> >
> >
> > --
> > fedora-list mailing list
> > fedora-list at redhat.com
> > To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
> >
> 
> If one has been using the system for awhile but doesn't want selinux
> to get in the way, is it more advisable to set it to permissive rather
> than disabling? I know that disabling selinux envolves relabelling the
> system. Is relabelling completely transparent, or can it lead to
> subtle problems?
----
The process of mass relabeling is transparent and yes, it can take some
time...depending upon how many files you have on your system and the
speed of your system/hard drive(s).

The problem is that if you decide to turn SELinux back on...

touch /.autorelabel && shutdown now -r

you may be presented with some problems that you will have to
troubleshoot after all the relabeling is done. Instead of dealing with
things as they come along, you may have many challenges at first boot
depending upon what kind of software you have installed and where you
installed it from. If you are only using Fedora packages, you shouldn't
have too many things to deal with.

It's a good idea to bring your system completely up-to-date before doing
the relabel/boot option so that you have all of the latest
SELinux-policy files.

Craig