Disabling selinux during OS installation does not work with CentOS 7.5

[Pansanel]

By default, selinux is disabled during the OS installation. However, starting with CentOS 7, selinux is only disabled during the installation, but is set as enabled after the installation. It was until now a minor issue, and was probably due to the missing selinux-policy package. We can see the following line in the anaconda.log file:

ERR anaconda: Error setting selinux mode: [Errno 2] No such file or directory: '/mnt/sysimage/etc/selinux/config'

With CentOS 7.5, the issue becomes worse, as the selinux context is not set on the filesystem and it prevent systemd to start correctly. Looking at the file context with the ls -Z command, you can see a '?' for the context for all the files. Setting the AII_OSINSTALL_SELINUX variable to permissive makes the installation succeed.

At least two solutions are available:

• Not to remove the selinux packages (I did not test this solution)
• Set the selinux to permissive by default on CentOS7.

[stdweird]

have you tried disabling selinux with ncm-grub. we have c75 hosts with selinuix=0; but they were upgrades, and there's no grub-awareness in aii, so we should reinstall a node to test it.

[stdweird]

@Pansanel can you add

yum install -y grubby
grubby --set-args=selinux=0

to the generated ks file, right before a line that starts with yum -c /tmp/aii/yum/yum.conf (so before the kernel is installed)

[ned21]

We also disable selinux via (ncm-)grub.

[Pansanel]

We does not need to disable SELinux. Using a permissive setup works fine. We should probably correct the way Quattor is doing the installation. I propose to fix the issue:

• Adding to the kickstart

  yum install -y grubby
  grubby --set-args=selinux=0

• Not to remove the selinux packages

[stdweird]

well, if selinux mode is disbaled, we can set selinux=0 and keep removing the packages. but if permissive mode is used, the packages shouldn't be removed

[stdweird]

if selinux is permissive, it shouldn't remove the selinux packages in current release