Setup SELinux on existing Tumbleweed error messages

[comraderachel]

So I followed the guide listed here https://en.opensuse.org/Portal:SELinux/Setupto switch to SELinux, and it does look like I am getting errors at step 9. One has already been reported, and I created a ticket for the other in bugzilla.
1237534 – [SELinux] power-profiles-daemon is denied several file access
1238359 – [SELinux] denied { open } for pid=2669 comm="plymouthd"

Effecting plymouthd and power-profiles-.

I can’t tell if I should still leave SELINUX=permissive for now until a future update, or if I should continue with the next step and change SELINUX=enforcing?
If I leave it on permissive, when do I know when to change it to enforcing?

Just want to make sure so I don’t break my system boot.

Thank you

[malcolmlewis]

@comraderachel Is setroubleshoot-server installed, AFAIK should get journal messages on what to run. I use Cockpit here as it tell you what to run and what to do for a fix. However it likely needs to be reported as a bug…

From memory there was a report on the ML or maybe Matrix about power profiles so it may be fixed in a later SELinux policy update.

[arvidjaar]

@comraderachel

when do I know when to change it to enforcing?

If you opened bug report you hopefully will be notified when it is fixed. Otherwise you need to monitor changes to selinux-policy and check whether your problem is fixed.