Skip to content

Conversation

ca-hu
Copy link
Contributor

@ca-hu ca-hu commented Jul 22, 2025

Description

Improve SELinux article for SLE 16. Please check thourougly since I am not in the docs team and don't really know all the guidelines

DONE:

  • Fix incorrect commands
  • Rework SELinux Modes section: split out enabling/disabling into a seperate section that goes in a later part of the article and only keep SELinux modes section for SELinux modes. Details see in the commits bsc#1239717
  • Rework SELinux policy overview section: add section about targeted policy, reorder article, reword existing sections
  • Add SELinux administration section and reorder sections for booleans etc from top down with likely most used
  • Add section about which packages to install when
  • Rewrite selinux booleans explanation text to actually explain the reasons behind booleans
  • Rewrite selinux file context text to include how to modify file contexts and when it is necessary to do so
  • Add a section for port configuration
  • Add a section for setting permissive domain
  • Add a troubleshooting section
  • Rewrite module section
  • Add an initial custom modules writing section

Are there any relevant issues/feature requests?

  • bsc#1239717
  • bsc#1241391
  • likely PED-11208

Is this (based on) existing content?

yes

@ca-hu ca-hu changed the title Improve SELinux article for SLE16: Modes and Enabling/Disabling Improve SELinux article for SLE16 Jul 23, 2025
@Amrita42 Amrita42 self-assigned this Jul 23, 2025
@Amrita42
Copy link
Contributor

@ca-hu when it is ready for review , please tag me, thanks :)

@ca-hu
Copy link
Contributor Author

ca-hu commented Jul 29, 2025

@Amrita42 it is ready for review :)

I did not do spellchecking or grammar checks, could you do them according to your doc team guidelines and add it as commit on top? I assume you want to pick and choose or rewrite stuff I did according to doc team guideline anyway, so I think the easiest would be if you do the rest.
If you notice anything that does not make sense or have any questions, please let me know!

Also I think it would be good if selinux-tools section would be a different article. Also feel free to split the article if you think it is too long.

I would hand this over to you now :)

@ca-hu ca-hu marked this pull request as ready for review July 29, 2025 15:35
@ca-hu
Copy link
Contributor Author

ca-hu commented Jul 29, 2025

also let me know when you are done, then i can ask someone from the selinux team to do a quick proofread again :) thanks!

@ca-hu
Copy link
Contributor Author

ca-hu commented Jul 30, 2025

sorry, i found two additional things, done now

ca-hu added 22 commits August 14, 2025 17:50
We don't want to have the SELINUX=disabled option in the /etc/selinux/config
documented, since it is a dirty hack and mixing
enforcing/permissive and enabling/disabling can cause
issues during boot due to systemd being confused
(see bsc#1239717)

Therefor dropping SELINUX=disabled and adding a seperate section
for how to disable SELinux and re-enable it
Also reorder chapters into subchapters
- Add concept for selinux-policy-targeted
- Fix wording and add explanations in concepts/selinux-policy.md
- Restructure SLE 16 policy overview part in SELinux article
add a more clear example
The existing ordering is not intuitive, reorder with top down
with most used
Add more context regarding the concepts of booleans
... for administration and development
It did not look complete and it needed more explanation
Add description how to use SELinux ports with example on
how to change the SSH daemon port to port 2222
@Amrita42
Copy link
Contributor

Amrita42 commented Sep 1, 2025

@ca-hu thanks for the extensive review and additions . Lets keep tools within the article , its fine as is. You can now handover to someone from your team for a final check. Noe that , post that I will request Daria to review (she does the final style and grammar review in our team)

@ca-hu
Copy link
Contributor Author

ca-hu commented Sep 1, 2025

thanks, will do :)

- Move troubleshooting section up
- Fix some formulation and typos
@ca-hu
Copy link
Contributor Author

ca-hu commented Sep 4, 2025

i added some changes from the final check, otherwise looks good

changes:
6a864ec

basically some typo fixes and i moved the troubleshooting section back up, because it is super important as it is very tricky to do.

if you do not like the changes, you can just revert it with:
git revert 6a864ece7f4320f468552282a77ce1b262ce7a95

otherwise looks good from my side, can be merged :)
if we will find something else, we will let you know

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants