How to install & activate SELinux on minimal fedora templates?

User Support
1

Hi,

I am currently trying to create a minimal fedora template with selinux.

First, i install some packages:

sudo dnf install selinux-policy selinux-policy-targeted policycoreutils policycoreutils-python-utils

change this file: sudo nano /etc/selinux/config

SELINUX=enforcing
SELINUXTYPE=targeted

& then i restarted the template. But when running

sestatus

then it still shows that it is still disabled.

What did I do wrong?

1 Like
2

you would need to have same packages you have installed (preferably apply this to a new minimal fedora template) but then relabel the file system first then set selinux to enforce as the last step only , here is how to do it :slight_smile: :

NOTE: switch back the mode to permissive temporarily from /etc/selinux/config
then reboot the template ( reboot could be not needed yet) .

  1. next create a file called “.autorelabel” at the root directory ( include the dot at the beginning of file name ,make sure to put the dot after the slash :
sudo touch /.autorelabel
  1. shutdown the fedora minimal template (i personally ran) :
sudo reboot
  1. set minimal fedora template to run with security=selinux with qvm-prefs (from dom0) :
qvm-prefs vmname kernelopts "swiotlb=2048 security=selinux"

additionally increase maximum startup timeout so that relabeling file system will have sufficient time (it was under 1 minute in my case so 600 seconds is more than enough) :

qvm-prefs vmname qrexec_timeout 600

  1. then start the fedora template and check the relabeling progress -if needed- from qubes manager > open console in qube (option is greyed out until vm starts)
    template may restart on its own when relabel completes! if it does then run it again.

  2. run sestatus it should say enabled, try setting it to enforce finally :slight_smile:

sudo setenforce 1
  1. run sestatus to make sure its enforcing and remodify the /etc/selinux/config and add the enforcing policy back :
SELINUX=enforcing
3

Oh I forgot to emphasize that you would need to replace vmname In the commands I mentioned with the name of your minimal fedora template’s name of course