{"action":"opened","issue":{"url":"https://api.github.com/repos/scylladb/scylla/issues/2279","repository_url":"https://api.github.com/repos/scylladb/scylla","labels_url":"https://api.github.com/repos/scylladb/scylla/issues/2279/labels{/name}","comments_url":"https://api.github.com/repos/scylladb/scylla/issues/2279/comments","events_url":"https://api.github.com/repos/scylladb/scylla/issues/2279/events","html_url":"https://github.com/scylladb/scylla/issues/2279","id":221553393,"number":2279,"title":"v1.6.1 -> SELinux mode changes back to \"Enforcing\" after scylla node reboot","user":{"login":"tomer-sandler","id":25585995,"avatar_url":"https://avatars1.githubusercontent.com/u/25585995?v=3","gravatar_id":"","url":"https://api.github.com/users/tomer-sandler","html_url":"https://github.com/tomer-sandler","followers_url":"https://api.github.com/users/tomer-sandler/followers","following_url":"https://api.github.com/users/tomer-sandler/following{/other_user}","gists_url":"https://api.github.com/users/tomer-sandler/gists{/gist_id}","starred_url":"https://api.github.com/users/tomer-sandler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomer-sandler/subscriptions","organizations_url":"https://api.github.com/users/tomer-sandler/orgs","repos_url":"https://api.github.com/users/tomer-sandler/repos","events_url":"https://api.github.com/users/tomer-sandler/events{/privacy}","received_events_url":"https://api.github.com/users/tomer-sandler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-04-13T12:49:23Z","updated_at":"2017-04-13T12:49:23Z","closed_at":null,"body":"**Installation details**\r\nScylla version (or git commit hash): 1.6.1-20170218.2ea4da2\r\nscylla-kernel-conf-1.6.1-20170218.2ea4da2.el7.centos.x86_64\r\nscylla-tools-1.6.1-20170218.710229c.el7.centos.noarch\r\nscylla-server-1.6.1-20170218.2ea4da2.el7.centos.x86_64\r\nscylla-jmx-1.6.1-20170218.d0401e7.el7.centos.noarch\r\nscylla-conf-1.6.1-20170218.2ea4da2.el7.centos.x86_64\r\nscylla-1.6.3-20170405.5ab8601.el7.centos.x86_64\r\n\r\nCluster size: 3 nodes\r\nOS (RHEL/CentOS/Ubuntu/AWS AMI): Centos7\r\n\r\n\r\n1. Scylla installed -> run scylla_setup -> YES to disable SELinux -> reboot\r\n\r\n**vi /etc/sysconfig/selinux**\r\n**================**\r\n# This file controls the state of SELinux on the system.\r\n# SELINUX= can take one of these three values:\r\n#     disabled - SELinux security policy is enforced.\r\n#     permissive - SELinux prints warnings instead of disabled.\r\n#     disabled - No SELinux policy is loaded.\r\nSELINUX=disabled\r\n# SELINUXTYPE= can take one of these two values:\r\n#     targeted - Targeted processes are protected,\r\n#     minimum - Modification of targeted policy. Only selected processes are protected.\r\n#     mls - Multi Level Security protection.\r\nSELINUXTYPE=targeted\r\n\r\n**2. After I shutdown VM and started it next day:**\r\n[tomer@tomer-4cpu-15gb-centos7-loader9 ~]$ sudo sestatus\r\nSELinux status:                 enabled\r\nSELinuxfs mount:                /sys/fs/selinux\r\nSELinux root directory:         /etc/selinux\r\nLoaded policy name:             targeted\r\n**Current mode:                   enforcing  ==>> ????**\r\nMode from config file:          enforcing\r\nPolicy MLS status:              enabled\r\nPolicy deny_unknown status:     allowed\r\nMax kernel policy version:      28\r\n\r\n**3. I manually change it (in selinux file it is still disabled):**\r\n[tomer@tomer-4cpu-15gb-centos7-loader9 ~]$ sudo setenforce 0\r\n[tomer@tomer-4cpu-15gb-centos7-loader9 ~]$ sudo sestatus\r\nSELinux status:                 enabled\r\nSELinuxfs mount:                /sys/fs/selinux\r\nSELinux root directory:         /etc/selinux\r\nLoaded policy name:             targeted\r\n**Current mode:                   permissive  ==>> OK**\r\nMode from config file:          enforcing\r\nPolicy MLS status:              enabled\r\nPolicy deny_unknown status:     allowed\r\nMax kernel policy version:      28\r\n\r\n\r\n**4. Reboot VM**\r\n\r\nAfter reboot:\r\n=========\r\n[tomer@tomer-4cpu-15gb-centos7-loader9 ~]$ sestatus\r\nSELinux status:                 enabled\r\nSELinuxfs mount:                /sys/fs/selinux\r\nSELinux root directory:         /etc/selinux\r\nLoaded policy name:             targeted\r\n**Current mode:                   enforcing ==>> After boot becomes enforcing again**\r\nMode from config file:          enforcing\r\nPolicy MLS status:              enabled\r\nPolicy deny_unknown status:     allowed\r\nMax kernel policy version:      28\r\n"}}
{"actor":{"display_login":"tomer-sandler"}}