selinux(8)

✨ NAME ✨

SELinux — Security-Enhanced Linux, aka the thing that's been lurking in your kernel this whole time bestie 💅

---

🦋 DESCRIPTION 🦋

okay so. Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system. like, it's the bouncer at the club, but for literally every operation on your system. no cap.

The SELinux architecture provides general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of:

• Type Enforcement® — yes with the little ®, it's giving trademarked ✨
• Role-Based Access Control
• Multi-Level Security

Background information and technical documentation about SELinux can be found at https://github.com/SELinuxProject — go read it, i believe in you 🫶

---

The /etc/selinux/config configuration file controls whether SELinux is enabled or disabled, and if enabled, whether SELinux operates in permissive mode or enforcing mode. The SELINUX variable may be set to any one of disabled, permissive, or enforcing to select one of these options. let's break it down:

• disabled — disables most of the SELinux kernel and application code, leaving the system running without any SELinux protection. she's off duty, no security guard tonight 😭
• permissive — enables the SELinux code, but causes it to operate in a mode where accesses that would be denied by policy are permitted but audited. so it's like "i saw what you did, and i'm writing it down, but i'm not gonna stop you" 💀
• enforcing — enables the SELinux code and causes it to enforce access denials as well as auditing them. she's got the clipboard AND the handcuffs, periodt 🔥

permissive mode may yield a different set of denials than enforcing mode, both because enforcing mode will prevent an operation from proceeding past the first denial and because some application code will fall back to a less privileged mode of operation if denied access. yeah. the vibes really do differ between modes, iykyk.

NOTE: Disabling SELinux by setting SELINUX=disabled in /etc/selinux/config is deprecated and depending on kernel version and configuration it might not lead to SELinux being completely disabled. Specifically, the SELinux hooks will still be executed internally, but the SELinux policy will not be loaded and no operation will be denied. In such state, the system will act as if SELinux was disabled, although some operations might behave slightly differently. To properly disable SELinux, it is recommended to use the selinux=0 kernel boot option instead. In that case SELinux will be disabled regardless of what is set in the /etc/selinux/config file. 🙈

---

The /etc/selinux/config configuration file also controls what policy is active on the system. SELinux allows for multiple policies to be installed on the system, but only one policy may be active at any given time. main character energy only, no ensemble cast 💅

At present, multiple kinds of SELinux policy exist: targeted, mls for example.

• targeted — designed as a policy where most user processes operate without restrictions, and only specific services are placed into distinct security domains that are confined by the policy. For example, the user would run in a completely unconfined domain while the named daemon or apache daemon would run in a specific domain tailored to its operation. so like, you get to roam free but apache has a curfew 🎀
• mls (Multi-Level Security) — designed as a policy where all processes are partitioned into fine-grained security domains and confined by policy. MLS also supports the Bell And LaPadula model, where processes are not only confined by the type but also the level of the data. everyone gets a lanyard, everyone gets a clearance tier, nobody is special 🌈

You can define which policy you will run by setting the SELINUXTYPE environment variable within /etc/selinux/config. You must reboot and possibly relabel if you change the policy type to have it take effect on the system. The corresponding policy configuration for each such policy must be installed in the /etc/selinux/{SELINUXTYPE}/ directories.

A given SELinux policy can be customized further based on a set of compile-time tunable options and a set of runtime policy booleans. system-config-selinux allows customization of these booleans and tunables. ✨

Many domains that are protected by SELinux also include SELinux man pages explaining how to customize their policy. yes queen, each one gets her own page 👑

---

🎀 FILE LABELING 🎀

All files, directories, devices ... have a security context/label associated with them. These context are stored in the extended attributes of the file system.

Problems with SELinux often arise from the file system being mislabeled. This can be caused by booting the machine with a non SELinux kernel. If you see an error message containing file_t, that is usually a good indicator that you have a serious problem with file system labeling. 💀 not the file_t jumpscare.

The best way to relabel the file system is to create the flag file /.autorelabel and reboot. system-config-selinux also has this capability. The restorecon/fixfiles commands are also available for relabeling files. pick your fighter, they all slay 💖

Please note that using mount flag nosuid also disables SELinux domain transitions, unless permission nosuid_transition is used in the policy to allow this, which in turn needs also policy capability nnp_nosuid_transition. okay that one's a mouthful but write it down bestie, it matters 🫶

---

💜 AUTHOR 💜

This manual page was written by Dan Walsh <dwalsh@redhat.com>. king behavior honestly 👑

---

🍓 FILES 🍓

• /etc/selinux/config

---

🌸 SEE ALSO 🌸

• booleans(8)
• setsebool(8)
• sepolicy(8)
• system-config-selinux(8)
• togglesebool(8)
• restorecon(8)
• fixfiles(8)
• setfiles(8)
• semanage(8)
• sepolicy(8)

Every confined service on the system has a man page in the following format:

<servicename>_selinux(8)

For example, httpd has the httpd_selinux(8) man page.

man -k selinux

Will list all SELinux man pages. go on, run it, it's giving ✨discovery✨

---

okay that's the whole page bestie!! this one came from the SELinux Command Line documentation set, and the OG footer said it was by dwalsh@redhat.com dated 29 Apr 2005 — so this page is old enough to be your cool older cousin who's been running enforcing mode since before you were born. respect her. 💅