Selinux causes system to fail during boot

[koutsofios]

I upgraded several systems from 15.6 to slowroll.
it mostly went fine, except for several broken mirrors (having to do with python313 packages).

I did all the installs using the online migration tool, I let it install the packages and then I selected to use selinux and drop apparmor.

I then rebooted, and all the machines came up.
I also rebooted them again for some new updates.
all but one worked fine.

this old thinkpad laptop failed to boot with the message (approx):

You are in emergency mode. After logging in, type “journalct1 -xb” to view system logs, “systemctl reboot” to reboot, or “exit”
to continue bootup.
Enter root password for system maintenance (or press Control-D to continue):

entering the root password caused this error:

sulogin: failed to execute /bin/bash: Permission denied
sulogin: failed to execute /bin/sh: Permission denied
cannot execute su shell

I booted the recovery mode from a slowroll usb stick and checked the filesystem - no errors (using xfs)
I was able to run a bash command with that bash binary and it worked just fine so I suspected selinux.

I touched /.autorelabel and rebooted.
same error but checking (in recovery mode) the file /.autorelabel had been deleted so it tried to fix the labels anyway.

I then booted the 7.0.10-2.0.16 kernel but changed the boot line to say selinux=0 and it came up just fine.
I set this in the /etc/default scripts so it’s sticky and the system is working now.

one thing I noticed was that the file /etc/selinux/config is strange. it only has one line:
SELINUX = disabled

and nothing else. the other systems have several comment lines and the define: SELINUXTYPE=targeted
I have a script I got from somewhere that checks that all files mentioned in rpm packages are present on the system and it found no issues.

any ideas how to fix it so selinux is enabled?

[malcolmlewis]

@koutsofios Hi, you would need to add security=selinux selinux=1 to the boot options…

update-bootloader --add-option security=selinux
update-bootloader --add-option selinux=1
update-bootloader --config

[koutsofios]

that’s how it was when it wouldn’t boot.
somehow the selinux setup is messed up.
maybe reinstall some packages?

[malcolmlewis]

@koutsofios Then something is for sure messed up… perhaps use selinux=0 and test to see if it boots.

Else review the information here https://en.opensuse.org/Portal:SELinux/Setup

[marel]

@koutsofios

I then booted the 7.0.10-2.0.16 kernel but changed the boot line to say selinux=0 and it came up just fine.

What you could do I boot with enforcing=0instead of selinux=0 and then check ausearch what is triggering.

[koutsofios]

turns out only /etc/selinux/config was bad.
not sure how it happened, it actually rebooted once after the slowroll upgrade.
then I installed updates that included some selinux packages and then it failed.
no errors during the updates, no disk / filesystem issues.

anyway I fixed the config file and now it boots in ‘enforcing’ mode.

thanks