Le 11/04/17 à 16:53, Christian Göttsche a écrit :
I am using the boot flag *checkreqprot=0* without any complications or policy changes. @Laurent if you are willing, one could alter the selinux-activate script to set the boot flag
I think it's too late now to do that (and I don't know all the implications).
I prefer that this is changed in the kernel itself TBH
@BenMaybe we'll go with the new default for buster.if there are no objections from the Debian SELinux team or users, please do so