SELinux: Could not downgrade policy file

在配置nfs服务器，设定selinux时，碰到了SELinux: Could not downgrade policy file的错误提示，下文是其解决方案。

一、故障现象

    

     

      

       

      
      

       

        [root@system1 ~]# semanage fcontext -a -t 'public_content_t' '/protected(/.*)?'
       
      
     

      

       

      
      

       

        SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.
       
      
     

      

       

      
      

       

        SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.29: No such file or directory
       
      
     

      

       

      
      

       

        /sbin/load_policy: Can't load policy: No such file or directory
       
      
     

      

       

      
      

       

        libsemanage.semanage_reload_policy: load_policy returned error code 2.
       
      
     

      

       

      
      

       

        SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.
       
      
     

      

       

      
      

       

        SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.29: No such file or directory
       
      
     

      

       

      
      

       

        /sbin/load_policy: Can't load policy: No such file or directory
       
      
     

      

       

      
      

       

        libsemanage.semanage_reload_policy: load_policy returned error code 2.
       
      
     

      

       

      
      

       

        ValueError: Could not commit semanage transaction
       
      
    
   

 二、解决方案

    

     

      

       

      
      

       

        从故障的提示来看，说不能够降级策略文件，以及找不到policy.29这个文件
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# more /etc/redhat-release
       
      
     

      

       

      
      

       

        Red Hat Enterprise Linux Server release 7.0 (Maipo)
       
      
     

      

       

      
      

       

        [root@system1 ~]# uname -r
       
      
     

      

       

      
      

       

        3.10.0-123.el7.x86_64
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ###下面查看selinux配置，如下，为disabled状态
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# sestatus
       
      
     

      

       

      
      

       

        SELinux status: disabled
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# getenforce
       
      
     

      

       

      
      

       

        Disabled
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# rpm -q libsepol libsemanage libselinux
       
      
     

      

       

      
      

       

        libsepol-2.1.9-3.el7.x86_64
       
      
     

      

       

      
      

       

        libsemanage-2.1.10-16.el7.x86_64
       
      
     

      

       

      
      

       

        libselinux-2.2.2-6.el7.x86_64
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ### 临时修改selinux 配置
       
      
     

      

       

      
      

       

        [root@system1 ~]# setenforce 1 ###尝试设置为1，依旧提示关闭
       
      
     

      

       

      
      

       

        setenforce: SELinux is disabled
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# getenforce
       
      
     

      

       

      
      

       

        Disabled
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ### 查看enforce配置文件
       
      
     

      

       

      
      

       

        [root@system1 ~]# more /etc/sysconfig/selinux
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        # This file controls the state of SELinux on the system.
       
      
     

      

       

      
      

       

        # SELINUX= can take one of these three values:
       
      
     

      

       

      
      

       

        # enforcing - SELinux security policy is enforced.
       
      
     

      

       

      
      

       

        # permissive - SELinux prints warnings instead of enforcing.
       
      
     

      

       

      
      

       

        # disabled - No SELinux policy is loaded.
       
      
     

      

       

      
      

       

        #SELINUX=permissive
       
      
     

      

       

      
      

       

        SELINUX=disabled
       
      
     

      

       

      
      

       

        # SELINUXTYPE= can take one of these two values:
       
      
     

      

       

      
      

       

        # targeted - Targeted processes are protected,
       
      
     

      

       

      
      

       

        # minimum - Modification of targeted policy. Only selected processes are protected.
       
      
     

      

       

      
      

       

        # mls - Multi Level Security protection.
       
      
     

      

       

      
      

       

        SELINUXTYPE=targeted
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ### 手工修改配置文件
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# vi /etc/sysconfig/selinux
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        SELINUX=enforce
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# getenforce ###依旧为关闭
       
      
     

      

       

      
      

       

        Disabled
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ###不知道什么原因导致配置修改无法生效，于是尝试重启Linux
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        [root@system1 ~]# reboot
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ### 再次修改和执行都OK
       
      
     

      

       

      
      

       

        [root@system1 ~]# getenforce
       
      
     

      

       

      
      

       

        Permissive
       
      
     

      

       

      
      

       

        [root@system1 ~]#
       
      
     

      

       

      
      

       

        [root@system1 ~]#
       
      
     

      

       

      
      

       

        [root@system1 ~]# setenforce 1
       
      
     

      

       

      
      

       

        [root@system1 ~]#
       
      
     

      

       

      
      

       

        [root@system1 ~]# getenforce
       
      
     

      

       

      
      

       

        Enforcing
       
      
     

      

       

      
      

       
 
       
      
     

      

       

      
      

       

        ### 再次执行semanage成功
       
      
     

      

       

      
      

       

        [root@system1 ~]# semanage fcontext -a -t 'public_content_t' '/protected(/.*)?'
       
      
     

      

       

      
      

       

        [root@system1 ~]#