How to remove SELinux and go back to using AppArmor

English Applications
1

I would like to stick to AppArmor.

I just reinstalled Tumbleweed and realized it is too complicated for a regular non-sysadmin desktop user and would prefer to go back to how it was before in my previous install.
I tried just disabling SELinux, uninstalling SELinux (sudo zypper remove selinux-tools selinux-policy) installing SELinux (sudo zypper install apparmor-utils apparmor-profiles apparmor-parser) and enabling it in systemd but apparently I also need to have the properly compiled kernel to load the profiles. Also I installed the apparmor pattern in zypper/yast to be sure everything is installed, including 32-bit.
Are there any guides or could you provide more information on how to do it properly?

Thanks!

2

@lavadrop Reverse of this https://en.opensuse.org/Portal:SELinux/Setup (need boot options security=apparmor and then https://en.opensuse.org/SDB:AppArmor

Just remember at some point it’s going away…so better to get the hurt out of the way now :wink:

Having the setroubleshoot-server and setroubleshoot-plugins should be able to resolve most issues, likely most probably need bug reports, but you can also resolve by creating your own policy if required?

I have a pretty much default install of Tumbleweed here on a test system with sdboot/SELinux/btrfs etc and not seen anything show up regarding SELinux (Cockpit Client).

3

Alrighty then.

If I just installed AppArmor, how can I remove it? It seems to have cross dependencies with systemd and udev.

4

@lavadrop does the first link help on what to do?

Then from the second link, remove;

libapparmor
apparmor-profiles
apparmor-utils
apparmor-parser
yast2-apparmor
apparmor-docs
5

Thank you. It was easier to rollback to 2 hours ago, I had also installed lutris-apparmor that pulled a ton of dependencies I won’t need.

6

Do I also need to do touch /.autorelabel?
I have 2 btrfs secondary SSDs that contain user data. They mount without errors according to dmesg.

7

If this is a new installation, the easiest is to reinstall selecting AppArmor.

8

It was 3 days ago, I rolled back to this afternoon’s pre-zypper alterations and I’m back on the default SELinux install. However I have an instance of wine complaining that

steam[5905]: wine: Read access denied for device L"\??\Z:\", FS volume label and serial are not available.

9

This is mentioned here:
https://en.opensuse.org/Portal:SELinux/Common_issues

10

Well …

Obligatory question - does it start to work after

setenforce 0
11

Yes, yes it did.

12

Good. Then show

ausearch -ts today -m avc,user_avc,selinux_err,user_selinux_err
13

There are hundreds of denials.

14

I tried systemctl start selinux-autorelabel
and got
Failed to start selinux-autorelabel.service: Unit selinux-autorelabel.service not found.

15

If you’re a desktop user behind a firewall how do you feel about just disabling selinux? It’s a real pain sometimes and can really get in the way.

16

After distro upgrading to the snapshot that upgraded python, the SELinux policy that wasn’t being written to disk was finally fixed and now there are no more denials and my system seems labeled properly. I already disabled firewalld, I’d prefer to keep SELinux and help the SELinux openSUSE team improve with bug reports when issues happen.

3 Likes
17

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.