On Thu, Sep 10, 2020 at 03:46:38PM +0200, Michal Schorm wrote:
Does this mean, the "setenforce 0" won't work anymore?
No, setenforce will not be affected by this change.
I use it quite a lot to examine the denials and audit2allow to
generate updated rules which fixes my issues.
I would see the inability of such workflow as a major drawback for
*anyone* who doesn't just consume the default configuration.
e.g. "My database datadir should reside elsewhere"; "my container
should access pulseaudio socket"; "I've ran the default configuration
with my data and it crashed" ...
setenforce works only in SELinux enabled system and `setenforce 0` is to put
SELinux in permissive mode (not to disable SELinux), see "SELinux states and
modes" at
https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-seli...
Also it will be possible to switch between enforcing and permissive
using SELINUX=enforcing resp SELINUX=permissive in /etc/selinux/config as it is
now.
Petr