Reboot to change selinux state

[sjpb]

Handle SELinux state changes which require reboots to take effect (e.g. enabled to disabled)

[jovial]

Could we use setenforce 0 to avoid the reboot?

[sjpb]

Could we use setenforce 0 to avoid the reboot?

Hmm it'd be neat - I guess only if reboot is required (then don't actually reboot). However on one environment it turned out setting permissive != disabled so this might give us a state which doesn't match the rebooted state. Maybe I'd rather take the hit on rebooting if its necessary for predictable behaviour.

[jovial]

Could we use setenforce 0 to avoid the reboot?

Hmm it'd be neat - I guess only if reboot is required (then don't actually reboot). However on one environment it turned out setting permissive != disabled so this might give us a state which doesn't match the rebooted state. Maybe I'd rather take the hit on rebooting if its necessary for predictable behaviour.

Good point, agreed that rebooting is the cleanest solution here.