Which two commands relabel an SELinux system after a reboot?

The two standard methods to schedule a full SELinux filesystem relabel on the next system boot are creating a special flag file in the root directory or using a specific command designed for this purpose. The command touch /.autorelabel creates the required empty flag file. The init system (e.g., systemd) checks for the existence of this file during the boot process and, if found, initiates a complete relabeling of all files according to the loaded SELinux policy before mounting the filesystems for normal operation. The command fixfiles -F onboot is a utility that performs the same action by creating the /.autorelabel file.

A. Set kernel parameter autorelabel=0 would disable automatic relabeling at boot, which is the opposite of the desired outcome.

B. fixfiles -F relabel initiates an immediate relabeling of the filesystem without requiring a reboot, which does not match the question's criteria.

C. echo “relabel=1” > /.selinux is not a valid or recognized command or mechanism for scheduling an SELinux relabel.

E. Set kernel parameter selinux=0 completely disables the SELinux subsystem at boot; it does not trigger a relabel.

1. Oracle® Linux 8 Documentation

Managing Security and SELinux

Section 2.6.5

"Relabeling a File System". The documentation states: "To relabel the entire file system the next time the system boots

create an empty file named .autorelabel in the root directory and then reboot the system: sudo touch /.autorelabel... Alternatively

you can use the fixfiles command: sudo fixfiles -F onboot".

2. Red Hat Enterprise Linux 8 Documentation

Using SELinux

Chapter 8

Section 8.4

"Relabeling files". This document

relevant due to Oracle Linux's RHEL origins

confirms the same methods: "To relabel the entire file system during the next reboot

enter the following command as the root user: # touch /.autorelabel". It also describes the fixfiles onboot command for the same purpose.

3. fixfiles(8) Linux man page. The manual for the fixfiles utility describes the onboot action: "This command is run from the init script to relabel the machine on the next reboot. It is the same as touch /.autorelabel." This confirms that fixfiles -F onboot is an officially documented method equivalent to creating the .autorelabel file.