What is SELinux and how does it enhance security

· Category: Linux

Short answer

SELinux (Security-Enhanced Linux) enforces mandatory access control (MAC) policies that restrict what processes can do, even if they run as root. Unlike traditional file permissions, SELinux policies define what actions each process type can perform on each resource type. For basic Linux permissions, see how to manage file permissions.

Modes

  • Enforcing: Policies are actively enforced. Violations are blocked and logged.
  • Permissive: Violations are logged but not blocked. Useful for debugging.
  • Disabled: SELinux is turned off entirely.

Common commands

getenforce              # Check current mode
setenforce 0            # Switch to permissive
sestatus                 # Detailed status
ls -Z file.txt          # See SELinux context

Troubleshooting

When something fails silently due to SELinux, check /var/log/audit/audit.log. Use audit2allow to generate policy rules from denials.

Tips