On Tue, 8 Sep 2020 at 16:29, Ben Cotton <bcotton(a)redhat.com> wrote:
NOTE: Runtime disable is considered deprecated by upstream, and
using
it will become increasingly painful (e.g. sleeping/blocking) through
future kernel releases until eventually it is removed completely.
Speaking from personal experience, I've wasted days over the last
decade trying to debug a locally installed system service that was not
working where there were no messages in any of the logs (e.g. no AVCs)
-- and turning off selinux at runtime magically fixed the problem.
Whilst I'm of course in favour of fixing the lockdown issue, would it
also be fair to say that any selinux regression not triggering an AVC
(which is fixed using selinux=0) would block this kind of proposal?
Richard.