What Is SELinux? Complete Guide to SELinux Configuration, Modes, Commands, and Advantages
SELinux (Security-Enhanced Linux) is a kernel-level security framework that provides Mandatory Access Control (MAC) to protect Linux systems from unauthorized access, privilege escalation, and zero-day attacks.
Unlike traditional Linux permissions, SELinux enforces security policies even if a user or service is compromised.
In simple terms:
Even if an attacker gains access to a service, SELinux restricts what that service can do.
What Is SELinux in Linux?
SELinux is built into the Linux kernel and works by applying security policies that control:
- Which files a process can access
- Which network ports it can bind to
- Which system resources it can use
This makes SELinux a critical security feature for servers, cloud environments, containers, and enterprise Linux systems.
How SELinux Works (MAC vs DAC)
Traditional Linux security uses Discretionary Access Control (DAC), where users control file permissions.
SELinux adds Mandatory Access Control (MAC), where:
- Policies are enforced by the kernel
- Rules cannot be bypassed by root users
- Every process runs in a restricted domain
This dramatically reduces the attack surface.
SELinux Modes Explained
SELinux operates in three modes:
Enforcing Mode
- Actively blocks unauthorized actions
- Logs security violations
- Recommended for production systems
Permissive Mode
- Does not block actions
- Logs all policy violations
- Useful for troubleshooting and learning
Disabled Mode
- SELinux is completely turned off
- Not recommended due to security risks
SELinux Commands to Check Status
Check current SELinux mode:
getenforce
View detailed SELinux status:
sestatus
How to Change SELinux Mode
Temporary Change (Until Reboot)
setenforce 0 # Permissive
setenforce 1 # Enforcing
Permanent Change
Edit the configuration file:
/etc/selinux/config
Set:
SELINUX=enforcing
Common SELinux Configuration and Management Tasks
Fix SELinux File Contexts
restorecon -Rv /path
Allow Services on Custom Ports
semanage port -a -t http_port_t -p tcp 8080
Manage SELinux Booleans
setsebool -P httpd_can_network_connect on
SELinux Logs and Troubleshooting
View SELinux Denials
/var/log/audit/audit.log
Generate SELinux Allow Rules
audit2allow -a
Apply Policy Changes Using
semanage
restorecon
Advantages of SELinux
- Prevents privilege escalation attacks
- Limits damage from zero-day vulnerabilities
- Provides granular process-level security
- Strong isolation for web servers, databases, and containers
- Helps meet security compliance standards
(PCI-DSS, ISO 27001, CIS Benchmarks, NIST)
Why SELinux Is Important for Server Security
SELinux is widely used in:
- Red Hat Enterprise Linux (RHEL)
- CentOS / Rocky Linux / AlmaLinux
- Cloud and container platforms
It significantly strengthens Linux server hardening and is essential for enterprise and cloud security.
SELinux Interview Question – One-Line Answer
“SELinux enforces mandatory access control at the kernel level. Even if a service is compromised, SELinux limits what it can access, making it highly effective against privilege escalation and lateral movement.”
Frequently Asked Questions (FAQ)
Is SELinux required?
Yes, SELinux is strongly recommended for production and enterprise Linux systems.
Can SELinux be disabled?
It can be disabled, but doing so reduces system security and increases risk.
Is SELinux hard to manage?
With basic commands and proper labeling, SELinux becomes easy and predictable.