selinux class - mode switching when switching from unknown mode to permissive after reboot Command "getenforce" stdout is expected to match /^Permissive$/ Failure/Error: its(:stdout) { is_expected.to match(%r{^Permissive$}) } expected "Disabled\n" to match /^Permissive$/ Diff: @@ -1 +1 @@ -/^Permissive$/ +Disabled

selinux class - mode switching when switching from enforcing to disabled before reboot behaves like an idempotent resource applies with no errors Failure/Error: shell('setenforce Enforcing && test "$(getenforce)" = "Enforcing"') Beaker::Host::CommandFailure: Host 'rocky9-64-puppet7.example.com' exited with 1 running: setenforce Enforcing && test "$(getenforce)" = "Enforcing" Last 10 lines of output were: setenforce: SELinux is disabled Shared Example Group: "an idempotent resource" called from ./spec/acceptance/class_disabled_spec.rb:60

selinux class - mode switching when switching from enforcing to disabled before reboot behaves like an idempotent resource applies a second time without changes Failure/Error: shell('setenforce Enforcing && test "$(getenforce)" = "Enforcing"') Beaker::Host::CommandFailure: Host 'rocky9-64-puppet7.example.com' exited with 1 running: setenforce Enforcing && test "$(getenforce)" = "Enforcing" Last 10 lines of output were: setenforce: SELinux is disabled Shared Example Group: "an idempotent resource" called from ./spec/acceptance/class_disabled_spec.rb:60

selinux class - mode switching when switching from enforcing to disabled before reboot File "/etc/selinux/config" content Failure/Error: shell('setenforce Enforcing && test "$(getenforce)" = "Enforcing"') Beaker::Host::CommandFailure: Host 'rocky9-64-puppet7.example.com' exited with 1 running: setenforce Enforcing && test "$(getenforce)" = "Enforcing" Last 10 lines of output were: setenforce: SELinux is disabled

selinux class - mode switching when switching from enforcing to disabled before reboot Command "getenforce" stdout Failure/Error: shell('setenforce Enforcing && test "$(getenforce)" = "Enforcing"') Beaker::Host::CommandFailure: Host 'rocky9-64-puppet7.example.com' exited with 1 running: setenforce Enforcing && test "$(getenforce)" = "Enforcing" Last 10 lines of output were: setenforce: SELinux is disabled

selinux class - mode switching when switching from enforcing to disabled after reboot applies without changes Failure/Error: apply_manifest(pp, catch_changes: true) Beaker::Host::CommandFailure: Host 'rocky9-64-puppet7.example.com' exited with 2 running: puppet apply --verbose --detailed-exitcodes /tmp/apply_manifest_022849150.q8iP0J.pp Last 10 lines of output were: Info: Loading facts Info: Loading facts �[mNotice: Compiled catalog for rocky9-64-puppet7.example.com in environment production in 0.06 seconds Info: Using environment 'production' Info: Applying configuration version '1717554530' �[mNotice: /Stage[main]/Selinux::Config/File_line[set-selinux-config-to-disabled]/ensure: created �[mNotice: Applied catalog in 0.04 seconds

selinux class - mode switching when switching from disabled to permissive after reboot Command "getenforce" stdout is expected to match /^Permissive$/ Failure/Error: its(:stdout) { is_expected.to match(%r{^Permissive$}) } expected "Disabled\n" to match /^Permissive$/ Diff: @@ -1 +1 @@ -/^Permissive$/ +Disabled

selinux class - mode switching when switching from disabled to permissive after reboot File "/var/test" selinux_label is expected to include ":var_t:" Failure/Error: its(:selinux_label) { is_expected.to include(":#{test_file_type}:") } expected "?" to include ":var_t:"

selinux class File "/etc/selinux/config" content is expected to match /^SELINUX=enforcing$/ Failure/Error: its(:content) { is_expected.to match(%r{^SELINUX=enforcing$}) } expected "\n# This file controls the state of SELinux on the system.\n# SELINUX=permissive\n# enforcing - ... processes are protected.\n# mls - Multi Level Security protection.\nSELINUXTYPE=targeted\n\n\n" to match /^SELINUX=enforcing$/ Diff: @@ -1,27 +1,53 @@ -/^SELINUX=enforcing$/ + +# This file controls the state of SELinux on the system. +# SELINUX=permissive +# enforcing - SELinux security policy is enforced. +# permissive - SELinux prints warnings instead of enforcing. +# disabled - No SELinux policy is loaded. +# See also: +# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/changing-selinux-states-and-modes_using-selinux#changing-selinux-modes-at-boot-time_changing-selinux-states-and-modes +# +# NOTE: Up to RHEL 8 release included, SELINUX=permissive +# fully disable SELinux during boot. If you need a system with SELinux +# fully disabled instead of SELinux running with no policy loaded, you +# need to pass selinux=0 to the kernel command line. You can use grubby +# to persistently set the bootloader to boot with selinux=0: +# +# grubby --update-kernel ALL --args selinux=0 +# +# To revert back to SELinux enabled: +# +# grubby --update-kernel ALL --remove-args selinux +# +SELINUX=permissive +# SELINUXTYPE= can take one of these three values: +# targeted - Targeted processes are protected, +# minimum - Modification of targeted policy. Only selected processes are protected. +# mls - Multi Level Security protection. +SELINUXTYPE=targeted