* [Topics](/en/topics "Topics") * What is SELinux (Security-Enhanced Linux)? What is SELinux (Security-Enhanced Linux)? ========================================== Published August 30, 2019•*4*-minute read Copy URL Jump to section --------------- What is SELinux?How does it work?DAC vs. MACHow to handle errorsRed Hat can help What is SELinux? ---------------- Security-Enhanced Linux (SELinux) is a [security](/en/topics/security) architecture for [Linux® systems](/en/topics/linux/what-is-linux) that allows administrators to have more control over who can access the system. It was originally developed by the United States National Security Agency (NSA) as a series of [patches](/en/topics/linux/what-is-linux-kernel-live-patching) to the [Linux kernel](/en/topics/linux/what-is-the-linux-kernel) using Linux Security Modules (LSM). SELinux was released to the [open source](/en/topics/open-source/what-is-open-source) community in 2000, and was integrated into the upstream Linux kernel in 2003. [Try an SELinux-enabled operating system for free](/en/technologies/linux-platforms/enterprise-linux/server/trial "product | red hat enterprise linux | trial") How does SELinux work? ---------------------- SELinux defines access controls for the applications, processes, and files on a system. It uses security policies, which are a set of rules that tell SELinux what can or can’t be accessed, to enforce the access allowed by a policy. When an application or process, known as a subject, makes a request to access an object, like a file, SELinux checks with an access vector cache (AVC), where permissions are cached for subjects and objects. If SELinux is unable to make a decision about access based on the cached permissions, it sends the request to the security server. The security server checks for the security context of the app or process and the file. Security context is applied from the SELinux policy database. Permission is then granted or denied. If permission is denied, an "avc: denied" message will be available in /var/log.messages. [How secure is your cloud? Take our assessment](/en/engage/hybrid-cloud-security-assessment) ### How to configure SELinux There are a number of ways that you can configure SELinux to protect your system. The most common are targeted policy or multi-level security (MLS). Targeted policy is the default option and covers a range of processes, tasks, and services. MLS can be very complicated and is typically only used by government organizations. You can tell what your system is supposed to be running at by looking at the /etc/sysconfig/selinux file. The file will have a section that shows you whether SELinux is in permissive mode, enforcing mode, or disabled, and which policy is supposed to be loaded. ### SELinux labeling and type enforcement Type enforcement and labeling are the most important concepts for SELinux. SELinux works as a labeling system, which means that all of the files, processes, and ports in a system have an SELinux label associated with them. Labels are a logical way of grouping things together. The [kernel](/en/topics/linux/what-is-the-linux-kernel) manages the labels during boot. Labels are in the format user:role:type:level (level is optional). User, role, and level are used in more advanced implementations of SELinux, like with MLS. Label type is the most important for targeted policy. SELinux uses type enforcement to enforce a policy that is defined on the system. Type enforcement is the part of an SELinux policy that defines whether a process running with a certain type can access a file labeled with a certain type. ### Enabling SELinux If SELinux has been disabled in your environment, you can enable SElinux by editing /etc/selinux/config and setting SELINUX=permissive. Since SELinux was not currently enabled, you don’t want to set it to enforcing right away because the system will likely have things mislabeled that can keep the system from booting. You can force the system to automatically [relabel the filesystem](https://access.redhat.com/solutions/24845) by creating an empty file named .autorelabel in the root directory and then rebooting. If the system has too many errors, you should reboot while in permissive mode in order for the boot to succeed. After everything has been relabeled, set SELinux to enforcing with /etc/selinux/config and reboot, or run setenforce 1. If a sysadmin is less familiar with the command line, there are graphic tools available that can be used to manage SELinux. SELinux provides an additional layer of security for your system that is built into [Linux distributions](/en/topics/linux/whats-the-best-linux-distro-for-you). It should remain on so that it can protect your system if it is ever compromised. [Optimize Linux security with Red Hat](/en/resources/optimize-linux-security-overview) Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") Discretionary access control (DAC) vs. mandatory access control (MAC) --------------------------------------------------------------------- Traditionally, Linux and UNIX systems have used DAC. SELinux is an example of a MAC system for Linux. With DAC, files and processes have owners. You can have the user own a file, a group own a file, or other, which can be anyone else. Users have the ability to change permissions on their own files. The root user has full access control with a DAC system. If you have root access, then you can access any other user’s files or do whatever you want on the system. But on MAC systems like SELinux, there is administratively set policy around access. Even if the DAC settings on your home directory are changed, an SELinux policy in place to prevent another user or process from accessing the directory will keep the system safe. SELinux policies let you be specific and cover a large number of processes. You can make changes with SELinux to limit access between users, files, directories, and more. How to handle SELinux errors ---------------------------- When you get an error in SELinux there is something that needs to be addressed. It is likely 1 of these 4 common problems: 1. **The labels are wrong.** If your labeling is incorrect you can use the tools to fix the labels. 2. **A policy needs to be fixed.** This could mean that you need to inform SELinux about a change you’ve made, or you might need to adjust a policy. You can fix it using booleans or policy modules. 3. **There is a bug in the policy.** It could be that a bug exists in the policy that needs to be addressed. 4. **The system has been broken in to.** Although SELinux can protect your systems in many scenarios, the possibility for a system to be compromised still exists. If you suspect that this is the case, take action immediately. ### What are booleans? Booleans are on/off settings for functions in SELinux. There are hundreds of settings that can turn SELinux capabilities on or off, and many are already predefined. You can find out which booleans have already been set in your system by running getsebool -a. Red Hat can help ---------------- Red Hat Enterprise Linux is the world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy. [Red Hat Enterprise Linux system roles](/en/blog/introduction-rhel-system-roles) are a collection of supported Ansible® roles that ensure consistent workflows and streamline the execution of manual tasks. System roles help teams automate security workflows and maintain them over time, at scale, and with minimal resources, as well as streamline governance and compliance requirements. With the SELinux system role, you can automate the deployment and management of SELinux. This includes: * Enabling SELinux with enforcing or permissive modes to ensure consistency of controls. * Customizing SELinux policy booleans, file contexts, ports, and logins to meet your requirements. * Utilizing the system role to reconcile file contexts on specified files or directories. [Learn more about Red Hat Enterprise Linux system roles](/en/blog/introduction-rhel-system-roles "Introduction to RHEL System Roles") Red Hat Enterprise Linux 10 --------------------------- Discover how Red Hat Enterprise Linux 10 addresses today’s most pressing IT challenges, from the Linux skills gap to post-quantum security. [Keep reading](/en/technologies/linux-platforms/enterprise-linux-10 "Red Hat Enterprise Linux 10") All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What is security automation? Security automation uses technology to perform tasks with reduced human assistance to integrate security processes, applications, and infrastructure. [Read the article](/en/topics/automation/what-is-security-automation "article | what is security automation") ### What is SOAR? SOAR refers to 3 key software capabilities that security teams use: case and workflow management, task automation, and a centralized means of accessing, querying, and sharing threat intelligence. [Read the article](/en/topics/security/what-is-soar "article | what is soar") ### What's an insider threat? An insider threat is leaked or misused data that—whether released accidentally or purposefully—could be used in malicious ways or viewed by individuals who shouldn’t have legitimate access. [Read the article](/en/topics/security/what-are-insider-threats "article | What's an insider threat") Security resources ------------------ ### Related content * Blog post [A decade of open innovation: Red Hat continues to scale the open hybrid cloud with Microsoft](/en/blog/decade-open-innovation-red-hat-continues-scale-open-hybrid-cloud-microsoft) * Blog post [Reducing CVE fatigue with Red Hat Hardened Images and Anchore](/en/blog/reducing-cve-fatigue-red-hat-hardened-images-and-anchore) * Overview [Build a strong infrastructure foundation with Red Hat expertise](/en/resources/build-strong-foundation-expertise-overview) * Blog post [Red Hat Device Edge now available to run on NVIDIA Jetson Orin](/en/blog/red-hat-device-edge-now-available-run-nvidia-jetson-orin) ### Related articles * [What is microsegmentation?](/en/topics/virtualization/microsegmentation) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is patch management?](/en/topics/management/what-patch-management-and-automation) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is an image builder?](/en/topics/linux/what-is-an-image-builder) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is SOAR?](/en/topics/security/what-is-soar) * [Why choose Red Hat for Linux?](/en/topics/linux/why-choose-red-hat-enterprise-linux) * [Why run Microsoft SQL Server on Linux?](/en/topics/linux/why-run-sql-server-on-linux) * [How to move to Red Hat Enterprise Linux from other Linux distros](/en/technologies/linux-platforms/enterprise-linux/migration-process/convert2rhel) * [Linux for cloud computing](/en/topics/linux/linux-for-cloud-computing) * [What is Linux?](/en/topics/linux/what-is-linux) * [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography) * [What is the SAP HANA migration?](/en/topics/linux/what-is-sap-hana-migration) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [Why run Linux on AWS?](/en/topics/linux/linux-on-aws) * [What is high availability?](/en/topics/linux/what-is-high-availability) * [What is ERP?](/en/topics/linux/what-is-erp) * [What is SAP HANA (and why does it run on Linux)?](/en/topics/linux/sap-hana-and-linux) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [Why run Linux on IBM Cloud](/en/topics/linux/linux-on-ibm-cloud) * [What is CentOS Stream?](/en/topics/linux/what-is-centos-stream) * [What is access control?](/en/topics/security/what-is-access-control) * [Why choose Red Hat Enterprise Linux on Azure?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-azure) * [Why choose Red Hat Enterprise Linux on AWS?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-aws) * [What is a CVE?](/en/topics/security/what-is-cve) * [Linux on Azure](/en/topics/linux/linux-on-azure) * [Red Hat Enterprise Linux migration process](/en/technologies/linux-platforms/enterprise-linux/migration-process) * [What to know for Red Hat Enterprise Linux 7 End of Maintenance](/en/technologies/linux-platforms/enterprise-linux/rhel-7-end-of-maintenance) * [What is CentOS?](/en/topics/linux/what-is-centos) * [What to know about CentOS Linux EOL](/en/topics/linux/centos-linux-eol) * [Why run Linux on Google Cloud?](/en/topics/linux/linux-on-google-cloud) * [Red Hat Satellite on Red Hat Enterprise Linux](/en/technologies/management/satellite/satellite-for-rhel) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Why choose Red Hat Enterprise Linux on Google Cloud?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-google-cloud) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is Linux kernel live patching?](/en/topics/linux/what-is-linux-kernel-live-patching) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [What's the difference between Fedora and Red Hat Enterprise Linux](/en/topics/linux/fedora-vs-red-hat-enterprise-linux) * [What's the best Linux distro for you?](/en/topics/linux/whats-the-best-linux-distro-for-you) * [What is a Linux server?](/en/topics/linux/linux-server) * [What is a configuration file?](/en/topics/linux/what-configuration-file) * [What is high performance computing (HPC)?](/en/topics/high-performance-computing/what-is-high-performance-computing) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [What is a golden image?](/en/topics/linux/what-is-a-golden-image) * [ARM vs x86: What's the difference?](/en/topics/linux/ARM-vs-x86) * [What is an ARM processor?](/en/topics/linux/what-is-arm-processor) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is MPLS?](/en/topics/edge-computing/what-is-mpls) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [What is a Linux certification?](/en/topics/linux/linux-certification) * [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is the Linux kernel?](/en/topics/linux/what-is-the-linux-kernel) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is API security?](/en/topics/security/api-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) [More about this topic](/en/topics/security "More about this topic")