SELinux: what it is and its modes

Why another layer?

Normal Linux permissions are called DAC (discretionary access control): the owner of a file decides who may use it. The weakness: a program runs with the full rights of its user. If an attacker breaks into the web server process (user apache), they can read every file apache can read, and as root, everything.

SELinux (Security-Enhanced Linux) adds MAC (mandatory access control): rules written by the system, which even root cannot ignore in the moment. Every process and every file gets a label. The policy says which process labels may do what to which file labels. The web server runs with the label httpd_t and may read files labelled httpd_sys_content_t. Even if it is hacked, it cannot read /etc/shadow (shadow_t) or users' home directories (user_home_t).

The targeted policy

RHEL uses the targeted policy: network-facing and system services (httpd, sshd, named, postgresql and hundreds more) run in confined domains with strict rules. Users' own programs run mostly unconfined. So you meet SELinux mostly when you put service files in unusual places or use unusual ports.

The three modes

$ getenforce
Enforcing
$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
...
# setenforce 0        # permissive until reboot (or setenforce 1)
# getenforce
Permissive

The mode at boot

# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

You can also set the mode for one boot with kernel arguments: enforcing=0 boots permissive. On RHEL 9 the supported way to disable SELinux completely is the kernel argument selinux=0, not only the config file. But in real work, and in exams, the right answer is almost always: leave it enforcing and fix the label, boolean or port.

Common mistakes

• Following an internet guide that says "first, disable SELinux". This removes a major protection. Learn the three fixes in the next lessons instead.
• Leaving a server in permissive after troubleshooting. Run setenforce 1 when done and check /etc/selinux/config.
• Assuming SELinux is the problem every time. Check normal permissions and the firewall first; then look for AVC denials in the audit log.
• Disabling SELinux and later enabling it without a relabel. Files created meanwhile have no labels; the system may fail to boot. Use touch /.autorelabel before rebooting into enforcing.