📖 ~1 min read
Table of contents
Symptom & Impact
First boot of SLES 16 logs SELinux migration warnings even though AppArmor is the default LSM.
Environment & Reproduction
Seen on images that briefly enabled SELinux during preview phases.
Root Cause Analysis
Stale `/etc/selinux/config` or `selinux=1` kernel param confuses the boot scripts.
Quick Triage
Run `getenforce` and `cat /etc/selinux/config` to see the configured mode.
Step-by-Step Diagnosis
Inspect `journalctl -b 0 | grep -i selinux` for migration messages.

Solution – Primary Fix
Set `SELINUX=disabled` in `/etc/selinux/config` (or remove the file), then update GRUB.
Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

Solution – Alternative Approaches
Re-enable AppArmor explicitly: `systemctl enable –now apparmor`.
Verification & Acceptance Criteria
Boot logs show neither SELinux migration nor enforcement warnings.
Rollback Plan
Revert kernel parameters from snapper if changes break login.
Prevention & Hardening
Standardise on AppArmor in SLES 16 build profiles; remove SELinux artefacts.
Related Errors & Cross-Refs
Linked to confusion with RHEL-style audit messages.
Related tutorial: View the step-by-step tutorial for sles-16.
View all sles-16 tutorials on the Tutorials Hub →
Browse all common problems & solutions on the Tutorials Hub.
References & Further Reading
SUSE security and AppArmor migration notes.
Need Expert Help?
If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.