Enabling SELinux in existing FlashGrid Server (non-clustered) with RHEL/OL 9 – FlashGrid Help Center

This guide describes how to enable SELinux on an existing FlashGrid Server (non-clustered) that had SELinux disabled.

Note: FlashGrid Server deployed with Launcher versions 25.12 or earlier had SELinux disabled by default. FlashGrid Server deployed with Launcher versions 26.03 or newer have SELinux enabled in Permissive mode by default on RHEL/OL 9.

Note: This article does not apply to RHEL/OL 7/8

Note: Enabling SELinux may impact third-party software or custom applications installed on your FlashGrid Server. This procedure has been validated only with standard FlashGrid and Oracle software. If you have additional software installed, thoroughly test in a non-production environment and monitor for denials specific to your applications before enabling Enforcing mode.

Note: If the FlashGrid Server was recently deployed and has not been rebooted yet, then reboot it before proceeding with this article.

Prerequisites

Perform a full backup of the FlashGrid Server. Choose the method according to your cloud provider:
FlashGrid Server (non-clustered) on AWS. Backup Best Practices
FlashGrid Server (non-clustered) on Azure. Backup Best Practices
FlashGrid Server (non-clustered) on GCP. Backup Best Practices
Perform changes in a lower environment before production
Check the enforcement settings and follow the corresponding Phase of the document

# getenforce

Disabled - Follow all Phases (1-3) of the implementation, transitioning from Disabled -> Permissive -> Enforcing.
Permissive - Skip Phase 1 and proceed with Phase 2 and Phase 3, transitioning from Permissive -> Enforcing.

Phase 1: Enable Permissive Mode

Perform these steps on each node, one at a time.

Verify the FlashGrid Server status is Good before proceeding
```
# flashgrid-cluster
```
Check the enforcement settings
```
# getenforce
```
Expected output: Disabled
Remove the immutable setting from the SELinux config file:
```
# chattr -i /etc/selinux/config
```

Change the setting from Disabled to Permissive

# sed -i 's/SELINUX=disabled/SELINUX=permissive/' /etc/selinux/config

To prevent incorrectly labeled and unlabelled files from causing problems, enable relabel for next boot using the command below:
```
# fixfiles -F onboot
```
Restart the FlashGrid Server by following the Rebooting a system (FlashGrid Server) procedure.
Re-apply the immutable setting for the SELinux config file:
```
# chattr +i /etc/selinux/config
```
Check the enforcement settings
```
# getenforce
```
Expected output: Permissive

Phase 2: Monitor SELinux denials

After enabling Permissive mode on the FlashGrid Server, monitor for SELinux denials. Only proceed to Enforcing mode once monitoring is complete.

Check all denials from today

# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts today

Checking recent denials (last 10 minutes)
```
# ausearch -m avc -ts recent
```
Monitoring denials using audit.log
```
# tail -f /var/log/audit/audit.log
```
Note: Before proceeding to Enforcing mode, ensure all scheduled jobs have executed during the monitoring period. If your environment has weekly jobs, monitor for at least one week. If you have monthly jobs (e.g., month-end processing, backups, reports), wait until those have run. SELinux denials may only appear when these periodic processes execute.

Phase 3: Enable Enforcing Mode

This procedure doesn't require any downtime or reboot.

Remove the immutable setting
```
# chattr -i /etc/selinux/config
```
Configure SELinux mode to Enforcing in /etc/selinux/config for persistence
```
# sed -i 's/SELINUX=permissive/SELINUX=enforcing/' /etc/selinux/config
```
Enable immutable setting
```
# chattr +i /etc/selinux/config
```
Setting enforcement to Enforcing
```
# setenforce 1
```

Emergency Rollback

If issues occur after enabling Enforcing mode, revert to Permissive immediately:

# setenforce 0

In case you want to make Permissive mode persistent across reboots:

# chattr -i /etc/selinux/config
# sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
# chattr +i /etc/selinux/config

Known Issues

Oracle AHF

While in permissive mode, you may encounter audit logs like the following. Oracle AHF triggers execution of the ip command, which is denied by SELinux:

time->Mon Apr 20 17:49:02 2026
type=PROCTITLE msg=audit(1776707342.002:781): proctitle=6970002D73006C696E6B
type=SYSCALL msg=audit(1776707342.002:781): arch=c000003e syscall=16 success=no exit=-25 a0=1 a1=5401 a2=7fff0d4e3fd0 a3=fff items=0 ppid=36928 pid=36938 auid=4294967295 uid=3002 gid=2000 euid=3002 suid=3002 fsuid=3002 egid=2000 sgid=2000 fsgid=2000 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:ifconfig_t:s0 key=(null)
type=AVC msg=audit(1776707342.002:781): avc:  denied  { ioctl } for  pid=36938 comm="ip" path="/u01/app/grid/oracle.ahf/data/repository/suptools/rac1/oswbb/grid/archive/oswnetstat/rac1.mycompany.mydomain_netstat_26.04.20.1700.dat" dev="dm-0" ino=84104715 ioctlcmd=0x5401 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=file permissive=1

Oracle has not provided a permanent fix for this issue. Below is a recommended workaround:

# ausearch -m AVC -ts recent -x /usr/sbin/ip -sc ioctl -se ifconfig_t | audit2allow -M oracle_ahf_oswbb_ip_ioctl
# semodule -i oracle_ahf_oswbb_ip_ioctl.pp

SELinux will now permit the recently denied ip command.