SecurityEnhanced

SecurityEnhanced, commonly known as SELinux, is a Linux kernel feature and set of user-space tools that implements mandatory access control (MAC) for Linux systems. It enforces security policies that restrict how programs, files, and other system resources may be accessed, reducing the impact of software flaws and misconfigurations.

Key concepts include security context labels, Type Enforcement (TE), roles, and policies. Processes, files, devices, and other objects are labeled with security contexts, and access decisions are made by the policy. The system can operate in enforcing mode (deny violations), permissive mode (log violations without enforcing), or disabled mode. Administrators tune behavior through policy adjustments and context labeling to achieve least-privilege operation.

Policy in SELinux defines allowed interactions between subjects and objects. Distributions ship policies that range from targeted policies focusing on specific services to more extensive MLS/MCS configurations for stronger isolation. Admins use tools such as semanage, setenforce, and sestatus to manage booleans, modules, and policy settings, and restorecon or chcon to adjust labels as needed.

History and usage: SELinux originated in the United States National Security Agency with contributions from the Secure Computing Corporation and was released as open-source software in the early 2000s. It has since been integrated into major Linux distributions, notably Red Hat Enterprise Linux and Fedora, and is used in other Linux systems to provide finer-grained access control beyond traditional discretionary permissions.

Benefits and challenges: SELinux can significantly improve security by containing processes and enforcing least-privilege principles. However, policy complexity and the potential for misconfiguration can cause operational issues. When properly configured, SELinux offers robust protection against privilege escalation and containment of compromises.