Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) system for Linux. It uses labels called security contexts and policy rules to control how processes interact with files and other system resources, adding restrictions beyond ordinary user, group, and other permissions.
What SELinux does
SELinux answers a question ordinary file permissions may not fully address: may this process perform this action on this resource? For example, policy can determine whether a web server process may read files in users’ home directories. Red Hat’s RHEL 10 SELinux guide describes SELinux as applying policy rules to decide which interactions are allowed; interactions without an applicable allow rule are denied.
As an Amazon Associate I earn from qualifying purchases.
SELinux can limit what an application is able to do if it is compromised, such as restricting access to files or network resources. It does not prevent every compromise, and its protection depends on the active policy and system configuration.
How contexts and policy work
A security context is a label attached to a process or resource. SELinux policy uses those labels to decide which operations are permitted. This gives administrators a way to restrict interactions based on the role and type of the process and resource, rather than relying only on file ownership and permission bits.
#1 Best Overall
For example, an older Red Hat Enterprise Linux 6 targeted-policy guide uses the file type httpd_sys_content_t in an example of content that the httpd process is permitted to access under that policy. That label is illustrative, not a universal current default. The same historical guide notes that changes made with chcon do not survive filesystem relabeling. See Red Hat’s RHEL 6 targeted-policy documentation for the example.
SELinux compared with ordinary Linux permissions
Traditional discretionary access control (DAC) uses ownership and user, group, and other permission bits to govern access. SELinux implements mandatory access control (MAC) through policy rules based on contexts. In the RHEL 10 guide, SELinux checks follow DAC checks: passing ordinary permissions does not by itself guarantee access if SELinux policy denies the operation.
Rank #2
SELinux operating modes
Red Hat’s RHEL 8 documentation describes three modes. Their meanings below reflect that release’s guide; consult documentation for the Linux distribution and release you administer before changing a system’s configuration.
Recommended Free Tools
| Mode | What happens |
|---|---|
| Enforcing | The loaded policy is applied, and operations it denies are blocked. |
| Permissive | Resources continue to be labeled and would-be policy denials are logged, but those operations are not blocked. |
| Disabled | SELinux policy is not enforced. |
For these mode descriptions, see Red Hat’s RHEL 8 guide to SELinux states and modes. The exact administration steps and implications of changing modes should be checked against the target release’s documentation.
Quick Recap
What to keep in mind
- SELinux supplements ordinary permissions; it does not replace them.
- Labels, policy rules, defaults, and administration procedures vary across distributions and releases. The targeted-policy default described in Red Hat’s RHEL 6 guide should not be assumed for every current Linux system.
- A denial may reflect an intentional policy restriction, so identify the relevant process, resource label, and policy before changing configuration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
