Overview

Security-Enhanced Linux (SELinux) is a collection of kernel changes and user-space tools that add fine-grained, label-based access controls to a system. Rather than relying only on traditional discretionary permissions, SELinux enforces mandatory access control (MAC) rules to constrain what processes can do and which files, sockets, or other objects they may access. SELinux integrates with the Linux Security Modules framework inside the Linux kernel and is available for many Unix-like operating systems that adopt the LSM interface. It is an option or component, not a Linux distribution.

Key characteristics

SELinux assigns a security context (labels) to subjects (processes) and objects (files, ports, IPC). Policies define which contexts can interact and under what actions. A few core concepts:

  • Types: the primary mechanism used to allow or deny access between processes and resources.
  • Roles and users: higher-level constructs that group permissions and limit which types a login or role may assume.
  • Modes: enforcing (rejects disallowed actions), permissive (logs violations but allows them), and disabled.
  • Booleans and modules: runtime switches and loadable policy pieces that tailor behavior without recompiling a whole policy.

How it works in practice

Administrators label files and other objects and load a policy that expresses allowed interactions. When a process performs an operation, the LSM hook evaluates the request against the policy and either permits or blocks it. Common tools assist with configuration and troubleshooting: setenforce to change mode, semanage and semodule for policy management, and audit logs (often processed by auditd) to diagnose denials.

History and development

SELinux began as a project to introduce mandatory access controls into Linux and was developed with contributions from several organizations. It was merged into the mainline kernel via the LSM infrastructure so that policies could be enforced at many kernel hooks. Over time, distributions and vendors developed policy collections and user-space utilities to simplify administration and to ship curated, targeted policies for common server programs.

Uses, examples, and importance

SELinux is commonly used to confine network-facing services (web servers, databases, mail daemons), restrict the privileges of background jobs, and reduce the impact of vulnerabilities. It also plays a role in container and virtualization security by limiting what containerized processes can access. Administrators often enable it to meet hardening or compliance requirements because it can prevent a compromised service from accessing unrelated system areas.

Distinctions and practical notes

Unlike path-based systems, SELinux uses object labels, which makes policy decisions robust against file renaming and certain classes of race conditions. This contrasts with other Linux access-control systems that may use filesystem paths. Learning SELinux involves understanding policy structure and practicing common troubleshooting steps; permissive mode and audit logs are essential when adapting policies to a running system.

For further reading on implementation and administration see documentation that explains interaction with the Linux toolchain, details on mandatory access control (MAC), and guides to the Linux Security Modules framework. Community and vendor resources for integration with the kernel and for using SELinux on various Unix-like operating systems are widely available; note that packaging policies differs between distributions and is not tied to a single distribution.