Issue #555: F34 System-Wide Change: Remove support for SELinux runtime disable - release-notes

fedora-docs / release-notes

#555 F34 System-Wide Change: Remove support for SELinux runtime disable

Closed 3 years ago by mjahoda. Opened 3 years ago by bcotton.

This issue tracks the release note for the following Fedora Change:

https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable

If you own this change, please add additional information here that we should communicate to Fedora users. Specifically, please consider:

New features available because of this change - pick 2 or 3 that are important
Considerations for users of previous releases of Fedora (upgrade issues, format changes, etc.)
Links to any upstream Release Notes
If this helps Fedora be a superior environment for our target audiences, please explain how so that we can emphasize this.

Your notes to us do not need to be formally written. We will edit them and add details as needed. This is a way for you to ensure that we know what is critical about your change.

If you want to write this release note, then:

Assign this issue to yourself
Check the wiki page linked above, find out what the change is about
Determine whether the change actually made it into the release or not[0]
Write a draft release note using that information against the correct branch here, in Pagure. (or see below)
Get in touch with the contact person/people listed on the wiki page, either through IRC or e-mail, and ask them to check your draft for technical accuracy
Submit your Release Note as a PR to this repository.

Once you're done with the above, make sure to either commit the relnote to an appropriate section of the Release Notes book, or, if you're not familiar with Git, AsciiDoc, or whatever else, just add it to this issue as a comment and let pbokoc[1] know that you're done with this one and you'd like the note included. Be sure to do this at least one day before the final release (October 29 according to the current schedule). Also make sure to do this even for relnotes that haven't been checked by the change owner.

[0] You can do that by asking the change owner listed on the wiki page; alternatively you can infer it by checking the tracker bug (linked in Wiki) in Bugzilla and looking at its status; see bug comments for details. Ask someone on the mailing list or on IRC if you're not sure.
[1] In #fedora-docs on FreeNode (UTC+1 timezone, online mostly during the day on weekdays), or pbokoc @redhat.com if you can't get a hold of me on IRC.

Metadata Update from @mjahoda:
- Issue assigned to mjahoda

3 years ago

mjahoda commented 3 years ago

@omos @plautrba I would go with the following description of this change:

= Support for disabling SELinux through /etc/selinux/config has been removed

With this release, support for disabling SELinux through the SELINUX=disabled option in the /etc/selinux/config file has been removed from the kernel. Furthermore, the Anaconda installation program and the corresponding man pages have been updated to reflect this change. This change also enables read-only-after-initialization protection for the Linux Security Modules (LSM) hooks.

If your scenario requires to disable SELinux, add the selinux=0 parameter to your kernel command line. See the link:https://docs.fedoraproject.org/en-US/quick-docs/changing-selinux-states-and-modes/[Changing SELinux states and modes] section in Fedora Quick Docs and the link:https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable[] for more information.

omos commented 3 years ago

@mjahoda Sounds good to me, thanks! I noticed just one nit: s/Linux Security Modules/Linux Security Module/ (since the "hooks" after it is already plural).