SELinux Error with Fedora 43
I hit an issue with Fedora 43 recently on my Framework laptop. After a reboot the machine was stuck at a loading screen indefinitely.
Pressing Esc I was able to see some helpful log
entries.
...
systemd[1]: Unable to fix SELinux security context of /dev/tty37: Permission denied
systemd[1]: Unable to fix SELinux security context of /dev/tty38: Permission denied
systemd[1]: Unable to fix SELinux security context of /dev/tty39: Permission denied
...
systemd[1]: Too many messages being logged to kmsg. Ignoring
...
...;type=boot[!!!!!!] Failed to allocate manager object.
I was only able to boot to a meaningful state by editing the GRUB
boot entry and adding selinux=0 to the boot command
line. With that temporary workaround I could boot into Fedora.
Google AI results then suggested a series of commands that resolved my issue.
Create a trigger file in the root (/) of the
filesystem to cause a filesystem relabel. Interestingly, this file
already existed on my machine. I’m assuming something went
wrong with a past Fedora upgrade on my machine so that this file
was created, but the relabeling did not succeed.
sudo touch /.autorelabel
Update the SELinux config file.
sudo nano /etc/selinux/config
Change the line with SELINUX=enforcing to
SELINUX=permissive. This allows the machine to
perform the relabel on the next reboot.
Reboot and do not hack the GRUB boot entry as before. Instead,
boot as normal. Pressing Esc while the system boots
shows some new progress.
...
selinux-autorelabel[1486]: *** Warning -- SELinux targeted policy relabel is required.
selinux-autorelabel[1486]: *** Relabeling could take a very long time, depending on file
selinux-autorelabel[1486]: *** system size and speed of hard drives.
...
selinux-autorelabel[1464]: Relabeling / /boot /dev /dev/hugepages /dev/mqueue /dev/pts /dev/shm /home /run /sys /sys/fs/cgroup /sys/fs/pstore /sys/kernel/debug /sys/kernel/tracign /tmp
...
Eventually the system should boot normally.
We can now restore the original settings in
/etc/selinux/config and set
SELINUX=enforcing.
At this point my system was able to reboot again normally.