Enforcing SELinux prevents bootable disk (Emergency Mode)

English Install/Boot/Login
1

Hi, I have a HP Pavilion g6 laptop with openSUSE Tumbleweed 20241226 snapshot installed.

Following SELinux setup guide here : < Portal:SELinux/Setup - openSUSE Wiki

I have created a custom named system snapshot with Snapper.

Problem starts after completion of step 10 of guide.

Step 10: After verifying there are no denials, using an 
editor such as nano,edit */etc/selinux/config* and set the values
SELINUX=enforcing

reboot machine then results in Emergency Mode.
Image of Emergency mode :< openSUSE Paste
It is then a failure to mount /boot/efi and /home problem.

I did not use wipefs prior to installing Tumbleweed on the machine. Here is lsblk -f output :< openSUSE Paste

Secure boot is disabled and I wish it to be in this use case. I have rolled the machine back and reattempted in order to verify that steps taken are in compliance with the SELinux openSUSE Tumbleweed guide. The problem persists.

How can I remedy this situation?

2

You can start with showing the actual errors. Your photo is unreadable and it does not contain any useful information beyond “failed to mount” anyway. The question is, why it failed to mount.

You can always boot with selinux=0 kernel parameter if you believe it is SELinux problem.

3

Ok, well I tried to follow the SELinux guide once again. This is a paste where the boot situation is now. It’s worse now for certain. openSUSE Paste

I really need to understand more about where to find the appropriate rescue system if that is what is needed to continue the operation here.

4

@arvidjar Hi, I created a openSUSE rescue disk and it loads correctly with dos disklabel type now . The problem is beyond the above now. This is a screenshot of lsblk -f once logged into openSUSE Rescue System as root. :< https://paste.opensuse.org/
I would like to open up the LUKS LVM and attempt to fix the bootloader by adding for lack of better words an MBR of grub somehow. i think? /sda/sd1 exists because of no wipefs used to prior to Tumbleweed installation on the SSD.

5

Is incorrect, need this link to view lsblk -f output :< openSUSE Paste

6

The machine boots now. I have lost the coloring in bootmenu. Current output of lsblk is as follows:

lsblk -f
NAME                                                FSTYPE      FSVER    LABEL UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sda                                                                                                                                  
├─sda1                                              vfat        FAT32          F05A-777C                               504.9M     1% /boot/efi
└─sda2                                              crypto_LUKS 2              c5fd719d-ee9d-4ac1-bde0-51c37e1db658                  
  └─cr_ata-Crucial_CT120M500SSD1_14160C176514-part2 LVM2_member LVM2 001       fbUCMC-YSny-64HS-SZkf-GFze-JpKT-Ndej3c                
    ├─system-root                                   btrfs                      f85d9ad1-6fd5-4e70-aaa7-7adae4638af3     24.7G    42% /var
    │                                                                                                                                /usr/local
    │                                                                                                                                /srv
    │                                                                                                                                /root
    │                                                                                                                                /opt
    │                                                                                                                                /boot/grub2/x86_64-efi
    │                                                                                                                                /.snapshots
    │                                                                                                                                /
    ├─system-swap                                   swap        1              7f5292f4-4450-40bd-9230-7252287d6e08                  [SWAP]
    └─system-home                                   xfs                        23fcc4bb-d3e0-4971-a32c-1f98f952f36d     42.5G    22% /home

I’m not certain this is the correct setup for the boot loader to be.

7

Done some more work getting things more straightened out here. SELinux is now installed and enforcing. I think previously it was not labeling correctly when the reboot was attempted. Boot menu has it’s fancy wallpaper back also. So i’m going to mark this as ‘solved’.

Thanks for the tip!

8

I’m pretty sure that having selinux=0 disables SELinux, so it is not enforcing anything.

9 
 cat /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-6.12.6-1-default root=/dev/mapper/system-root resume=/dev/system/swap splash=0 plymouth.enable=0 security=selinux selinux=1 amdgpu.dc=1 exp_hw_support=1 deep_color=1 sched_hw_submission=4 benchmark=1 mitigations=auto

sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

You’re right i’ll keep working on it then.

10

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.