2

My company has previously used Scientific Linux 6.2 for most services and I want to begin standardization on CentOS. As part of the migration I also want to disable SELinux, with the intent of re-enabling when it has a better adoption rate.

I plan to stand up the server and migrate the conf files over for the necessary services. Are there any implications, given the change to both SELinux and SL, that I need to be aware of during the migration? I will most likely be virtualizing the physical servers as well.

4 Answers 4

6

No, no major implications...

You're basically asking if you can move a Red Hat derivative operating system running SELinux to one without SELinux... Or really, "can I disable SELinux?"

Remember that Scientific Linux and CentOS are derived from the upstream Red Hat Enterprise Linux. The userlands are similar, the config files and binaries are compatible.

You can even convert the SL systems to CentOS in-place.

The conventions are the same. Scientific Linux was a popular alternative to CentOS around the period when CentOS was lagging behind RHEL during the move to EL6. It's lost momentum, though, and people are back to using CentOS as a primary RHEL alternative.

3
  • I should have figured there existed a migration guide. That probably would have saved me quite a bit of typing.
    – Scott Pack
    Feb 20, 2013 at 16:02
  • @ScottPack I do this all the time when people decide that they don't want to continue their RHEL subscriptions.
    – ewwhite
    Feb 20, 2013 at 16:06
  • Sure. I've only ever converted to RHEL, and even that has been seldom and mostly recently a good while ago.
    – Scott Pack
    Feb 20, 2013 at 16:10
3

Going from SELinux-enabled to disabled is usually not an issue. Its the other way around that can be problematic. So I would not worry about the SELinux items. In fact, you may want to turn it off to make migration easier.

As for SL, I am not familiar but if you are looking to standardize your environments, you will want to assure that SL's conf files follow the same layout and design used by CentOS.

If you use CentOS conventions for naming, configuration, and other files, then it will be easier for others to manage your systems.

3

Generally switching between RedHat clones of the same vintage is pretty easy. All you should have to do is download and install a handful of packages, then issue an update to bring in any patches that have been issued since your last one. Since you want to disable SELinux as well, it's only a small extra step.

As ewwhite mentioned, the differences between CentOS/ScientificLinux/RHEL are all fairly low key. They primarily come down to default included repositories and how quickly updates are released. Both CentOS and SL are, by design, binary compatible with RHEL.

I haven't tested this, but you should be able to do your migration as easily as this:

  1. Edit /etc/selinux/config and set SELINUX to disabled
  2. Reboot
  3. Delete the packages that define this as an SL system: rpm -e --nodeps sl-release sl-indexhtml
  4. Go to the mirror of your choice and browse to the CentOS 6.2 directory
  5. Download the rpms for centos-release-6 and centos-indexhtml-6
  6. Install these packages using rpm
  7. Perform a full update, this should also take you to 6.3: yum clean all && yum update -y yum && yum update -y glibc && yum update

After getting yourself a cup of coffee and a sandwich you should have a fully functional CentOS 6.3 system. Afterwards I would also recommend checking out your installed packages to look for any SL specific cruft that may be left behind.

 rpm -qa --qf "%{NAME} %{VENDOR} \n" | awk '/Scientific Linux/ {print $1}'

This will produce a list of all packages that are still installed that were built by the Scientific Linux group. You can simply issue a yum reinstall on each of those and get the CentOS specifics. Something like this should work.

rpm -qa --qf "%{NAME} %{VENDOR} \n" | awk '/Scientific Linux/ {print $1}' | xargs yum reinstall -y

After all this it might also be worth your time to look for old abandoned packages. Install the yum-utils package and run the package-cleanup --orphans command. That will give you a list of every installed package that is not in a currently configured repository. Manually review this list before taking any action. It will give you anything you've installed from SL that isn't available in CentOS as well as rpm you have downloaded and installed manually. So some of the orphans you may want, and some you may not.

As I said, I haven't tested this on anything recent, but I have successfully converted CentOS systems to RHEL using the above steps. Also, in this day and age the SELinux policies are good enough that they should very rarely cause you problems. If you decide to turn it back on you should be able to do something like this.

First edit the /etc/selinux/config file and change SELINUX to either targeted or strict. Then reboot to re-enable selinux. Then you'll need to have the system relabel everything. I would also restore all the contexts just to make sure.

genhomedircon
restorecon -R / # Add a -v if you're *really* curious

Some daemons don't do a great job of picking this up, so you may need to reboot again after doing this.

2
  • Install the yum-utils package, it contains package-cleanup, a program for all sorts of cleanings (remove duplicates, list packages that aren't in any configured repository, ...). yum distribution-synchronization might also be useful to bring package versions fully in line.
    – vonbrand
    Feb 20, 2013 at 18:54
  • @vonbrand: yum-utils is definitely useful for logs of different purposes. I suspect looking for orphans would probably work out well, I hadn't thought of that. The distribution-synchronization option is definitely new to me. I'll have to play with it and see exactly what kinds of things it can be abused for.
    – Scott Pack
    Feb 20, 2013 at 18:59
1

The only thing I can add is that you might want to do this in two stages. I would P2V first since there's not likely to be any trouble here and is least invasive on the original host. Then, you can snapshot the VM and try an in-place migration from SL6 -> CentOS.

It seems like this would be the quickest way to rollback if you had to if the migration doesn't go well. Don't forget to delete the snapshots after every thing is tested.

As mentioned, disabling SELinux is extremely unlikely to impact any thing. I will say that it's very well supported, though. The issue is that it takes more work than most folks are willing to put forth. You may want to put it in just permissive mode rather than disabling. No reboot would be required for re-enabling at a later time. Errors will still be logged, but no denies will take place in permissive mode.

1
  • 1
    It's pretty amazing how far the policies have come in the past few years. It's been a very long time since I've had an issue on a RHEL. Not at all like Fedora where, a few days ago, I had to issue a restorecon on /etc/hostname after running updates.
    – Scott Pack
    Feb 20, 2013 at 16:09

You must log in to answer this question.