SELinux

SELinux, or Security-Enhanced Linux, is a Linux kernel security module that provides mandatory access control (MAC). It imposes fine-grained restrictions on how processes interact with files, resources, and other processes, based on a customizable policy rather than relying solely on traditional discretionary access control.

SELinux was developed by the U.S. National Security Agency in collaboration with Red Hat and others. It is integrated into the Linux kernel via the Linux Security Modules (LSM) framework. It has been shipped with Fedora since its early releases and later became a core component of Red Hat Enterprise Linux and other distributions; it is available on many Linux flavors with varying levels of support.

The security model hinges on security contexts assigned to subjects (processes) and objects (files, sockets, devices). Contexts typically include user, role, type, and optional level fields. The primary policy mechanism is Type Enforcement, which defines domains for processes and types for resources and specifies allowed interactions. Policies can be targeted (focusing on specific services), strict (full policy coverage), and may implement MLS or MCS labeling for multi-level security. SELinux can run in enforcing, permissive, or disabled mode, allowing observation of policy effects without enforcement.

Administration involves labeling files and processes, configuring or loading policies, and managing policy modules. Common tools include setenforce, getenforce, sestatus, semanage, restorecon, and audit2allow, which derives allow rules from denials in logs. Troubleshooting often centers on denial messages and mislabeled files or contexts.

Benefits of SELinux include reduced impact from compromised services and improved containment of misconfigurations. Challenges include policy complexity and debugging. SELinux is widely used in enterprise Linux distributions and is frequently employed alongside container technology, where labels govern interactions between containers and the host system.