enforcing mode problems

[Tom London]

I relabel after each policy change.  If you don't, context changes 
reflected in the new policy files are not made.

tom

[On my system, yum/rpm seem not to be correctly labeling installed 
files, so I manually check and change via 'fixfiles' or 'setfiles' as 
appropriate. You can check by running 'fixfiles check'. This is 
especially tedious if updating the kernel/coreutils/selinux packages 
since improper labels could prevent rebooting in enforcing mode. When 
this happened to me, I added 'enforcing=0' to the boot line so I could 
relabel files in permissive mode.]
------------------------------------------------------------------------

    * /From/: Richard Hally <rhally mindspring com>
    * /To/: "Fedora SELinux support list for users & developers."
      <fedora-selinux-list redhat com>
    * /Subject/: Re: enforcing mode problems
    * /Date/: Tue, 08 Jun 2004 23:05:54 -0400

------------------------------------------------------------------------
Tom London wrote:

    Did you remember to do a 'fixfiles relabel' after installing the new
    policy files?

    If not, I suggest you reboot single-user mode, and then run
    'fixfiles relabel'. You probably want fixfiles to clean out /tmp, so
    move/copy anything you need before running it.

tom
------------------------------------------------------------------------


   * /From/: Richard Hally <rhally mindspring com>
   * /To/: fedora-selinux-list redhat com
   * /Subject/: enforcing mode problems
   * /Date/: Tue, 08 Jun 2004 22:43:44 -0400


    ------------------------------------------------------------------------
    when running with the latest "strict" policy in enforcing mode, 'su
    -' does not work.

[richard new2 richard]$ su -
Password:
could not open session



Thanks for the suggestion.
This system was installed over the past weekend and updated to the 
(then) latest strict policy. "fixfiles relabel" was run then to allow 
going to enforcing mode. "yum update" updated the policy today. I am 
wondering if "fixfiles relabel" will be necessary every time policy is 
updated?
Richard Hally