Re: Selinux - touch /.autorelabel before shutting down

On Thursday 08 September 2005 23:52, Jim Cornette <fct-cornette(a)insight.rr.com&gt; wrote: It would be handy to know which file or files were mis-labeled. It's possible that your system use has revealed a bug, but if so probably your use of selinux=0 has destroyed the evidence. Which is supposed to work (IMHO). I believe that you should be able to press reset or experience a power failure at any time without any catastrophic loss of data or any security compromise. Anything which causes a significant data loss or security compromise related to a power failure should be considered a serious bug. Touching /.autorelabel before shutdown would be a really bad idea. A relabel of all file systems will take at least 5 minutes on all combinations of hardware and install options that I've seen (it's possible that a combination of a minimal install and great hardware will take less time). On some combinations of hardware and installation options a relabel will take 30 minutes or more. It's possible that some non-optimal configurations will take many hours for a relabel (if you have a huge number of files such as a file system for Maildir storage then you should use the context= mount option to avoid this problem). Also in FC4 and above you can use the kernel boot parameter "autorelabel" to cause a relabel, so if your machine is messed up and you need to relabel there is no need to create a file on the file system or boot in permissive mode. You can just use the GRUB options to edit the boot command line. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page