Hi All,
I have an existing Tumbleweed installation with apparmor. I wanted to setup SELinux instead of apparmor, so I followed this guide to the letter.
At step #8 (i.e. the first boot with SELinux enabled where the system will (re-)label all files in the file system), I get errors and it fails to boot. After the errors, I had to revert back all my SELinux changes.
I get some “Failed to start Relabel […mountpoint…]” from systemd.
|03/10/2025 10:56|systemd|home-user-Virtualization-incus-disks-relabel.service: Main process exited, code=exited, status=255/EXCEPTION|
|---|---|---|
|03/10/2025 10:56|systemd|home-user-Virtualization-incus-disks-relabel.service: Failed with result 'exit-code'.|
|03/10/2025 10:56|systemd|Failed to start Relabel /home/user/Virtualization/incus/disks.|
|03/10/2025 10:56|systemd|Dependency failed for Mark autorelabel as done.|
|03/10/2025 10:56|systemd|mark-autorelabel-done.service: Job mark-autorelabel-done.service/start failed with result 'dependency'.|
|03/10/2025 10:56|systemd|home-user-Virtualization-incus-disks-relabel.service: Consumed 11.112s CPU time.|
|03/10/2025 10:56|systemd|home-relabel.service: Main process exited, code=exited, status=255/EXCEPTION|
|03/10/2025 10:56|systemd|home-relabel.service: Failed with result 'exit-code'.|
|03/10/2025 10:56|systemd|Failed to start Relabel /home.|
|03/10/2025 10:56|systemd|home-relabel.service: Consumed 1min 6.563s CPU time.|
|03/10/2025 10:56|systemd|Finished Relabel /timeshift.|
|03/10/2025 11:03|systemd|timeshift-relabel.service: Deactivated successfully.|
|03/10/2025 11:03|systemd|Stopped Relabel /timeshift.|
|03/10/2025 11:03|kernel|audit: type=1131 audit(1759482189.903:15): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=timeshift-relabel comm=systemd exe=/usr/lib/systemd/systemd hostname=? addr=? terminal=? res=success'|
|03/10/2025 11:03|dracut-pre-pivot|//lib/dracut/hooks/pre-pivot/50-selinux-microos-relabel.sh: line 125: /sysroot/etc/selinux/.autorelabel: Read-only file system|
From the boot.log I can only see that all disks/mountpoints get correctly decrypted and mounted but then the “relabel” fails:
[e[0;32m OK e[0m] Mounted e[0;1;39m/boot/efie[0m.
[e[0;32m OK e[0m] Mounted e[0;1;39m/homee[0m.
Starting e[0;1;39mRelabel /homee[0m...
[e[0;32m OK e[0m] Mounted e[0;1;39m/timeshifte[0m.
[e[0;32m OK e[0m] Mounted e[0;1;39m/home/user/Virtualization/incus/diskse[0m.
Starting e[0;1;39mRelabel /home/user/Virtualization/incus/diskse[0m...
Starting e[0;1;39mRelabel /timeshifte[0m...
[e[0;1;31mFAILEDe[0m] Failed to start e[0;1;39mRelabel /home/user/Virtualization/incus/diskse[0m.
See 'systemctl status home-user-Virtualization-incus-disks-relabel.service' for details.
[e[0;1;38:5:185mDEPENDe[0m] Dependency failed for e[0;1;39mLocal File Systemse[0m.
[e[0;1;38:5:185mDEPENDe[0m] Dependency failed for e[0;1;39mMark autorelabel as donee[0m.
And FYI:
user@laptop:~$ sudo cat /etc/fstab
[sudo] password for root:
LABEL=root / ext4 defaults 0 1
LABEL=home /home ext4 data=ordered 0 0
LABEL=timeshift /timeshift btrfs compress=zstd:8 0 0
LABEL=EFI /boot/efi vfat utf8 0 2
LABEL=swap swap swap defaults 0 0
LABEL=incus /home/user/Virtualization/incus/disks btrfs user,nofail,users 0 0
user@laptop:~$ sudo ausearch -m avc,user_avc,selinux_err,user_selinux_err -ts boot
<no matches>
user@laptop:~$ sudo cat /etc/default/grub
GRUB_DISTRIBUTOR=
GRUB_DEFAULT=saved
GRUB_HIDDEN_TIMEOUT=0
GRUB_HIDDEN_TIMEOUT_QUIET=true
GRUB_TIMEOUT=8
GRUB_CMDLINE_LINUX_DEFAULT="splash=silent resume=/dev/mapper/cr_swap quiet security=selinux selinux=1 mitigations=auto"
GRUB_CMDLINE_LINUX=""
GRUB_TERMINAL="gfxterm"
GRUB_GFXMODE="auto"
GRUB_BACKGROUND=
GRUB_THEME=/boot/grub2/themes/openSUSE/theme.txt
SUSE_BTRFS_SNAPSHOT_BOOTING="true"
GRUB_USE_LINUXEFI="true"
GRUB_DISABLE_OS_PROBER="false"
GRUB_ENABLE_CRYPTODISK="y"
GRUB_CMDLINE_XEN_DEFAULT="vga=gfx-1024x768x16"
user@laptop:~$
Any ideas very much appreciated!