fesco

#2471 F34 System-Wide Change: Remove support for SELinux runtime disable
Closed: Accepted by churchyard. Opened by bcotton.

Closed: Accepted
Reopen Issue

Remove support for SELinux runtime disable so that the LSM hooks can be hardened via read-only-after-initialization protections.

Migrate users to using selinux=0 on the kernel command line if they want to disable SELinux.

NOTE: By "disabling SELinux" here we mean that the kernel doesn't call into the SELinux subsystem at all. Switching SELinux between "permissive" and "enforcing" mode using setenforce(8) (which is often incorrectly called "disabling/enabling SELinux") is not affected and will remain fully functional. See the Fedora Documentation for more information about the SELinux modes.

+1

+1

+1

+1

+1

I abstain. I don't know much about the topic and I am not able to dedicate the time to investigate in timely manner. The proposal seem to have enough support even if I don't approve.

+1

+1

APPROVED (+7, 1, -0)

Metadata Update from @churchyard:
- Issue tagged with: pending announcement

Announced https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HNYFH3VRR5TNSYTQ6NRGICJO3UDA7SKS/

Metadata Update from @churchyard:
- Issue close_status updated to: Accepted
- Issue status updated to: Closed (was: Open)

Metadata Update from @bcotton:
- Issue untagged with: F34
- Issue set to the milestone: Fedora 34
Metadata
None

pending announcement system wide change

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.