After installed SELinux system is stuck and not booting
There's a permanent fix for it, You'll just need to press shift to boot in recovery mode then go to terminal then put disabled=1 then resume booting without a restart then go to /etc/selinux then go to the config file then default choice turn selinux=enforcing to selinux=disabled... There u go uve got ur machine booting again!
I've had a similar problem. In order to boot the machine, I stopped GRUB and edited the Ubuntu boot entry (press e) and removed SELinux temporarily from the boot arguments, just as explained by @poige in his answer.
Since AppArmor and SELinux conflict, I suggest this procedure to disable apparmor and install more SELinux packages:
-
Remove
apparmor
from your systemsudo systemctl stop apparmor sudo apt remove apparmor # I guess you could also just disable the service sudo apt update && sudo apt upgrade -yuf # (optional) this is just to update your system without prompts
-
Optional: You can purge
apparmor
later if you think you won't need it in the future:sudo apt purge apparmor
-
-
Reboot (if you get stuck in boot again, edit the GRUB entry to boot)
-
Install SELinux with some auxiliary packages:
sudo apt install selinux selinux-utils selinux-basics auditd audispd-plugins sudo sestatus # SELinux should be disabled now sudo reboot
-
Note: After rebooting your system, SELinux should be enabled, but in permissive mode. Permissive mode means any actions that would have been disallowed are allowed, but logged in your system’s audit log located in the
/var/log/audit/audit.log
file.
-
Note: After rebooting your system, SELinux should be enabled, but in permissive mode. Permissive mode means any actions that would have been disallowed are allowed, but logged in your system’s audit log located in the
-
After reboot, check that
selinux
is installed:$ sudo sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: default Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: requested (insecure) Max kernel policy version: 31
Now you should be able play with SELinux and change its settings to get your desired level of security. More info about this in Installing SELinux on Ubuntu 18.04.
Bad thing is Ubuntu is a bad choice for playing with SELinux — they pet Apparmor instead (which isn't up to SELinux' level with quite different approach, but that's another story).
The issue you've run into is easy to fix (that was good thing part):
- During boot you'd need to get to GRUB's menu and edit kernel's parameter which enforces use of SELinux:
selinux=1
. - Unset it with
…=0
(IOW, replacing 1 with 0) and proceed with booting then.
At this point the system should be successfully booted but it's not all done yet.
— It's time to put long-term fix. May be uninstall SELinux? :) It might still be not enough though. Checkout /etc/default/grub
with an sudo …YourEditor…
and if you'd see there
GRUB_CMDLINE_LINUX_DEFAULT="security=selinux selinux=1"
cut it down to empty string after assignment: …LT=""
then sudo update-grub
to re-generate GRUB's config.