SELinux

SELinux (Security-Enhanced Linux)

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides a mechanism for supporting access control security policies, designed to enhance the security of Linux systems by allowing administrators to have more control over who can access the system.

What is SELinux?

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides a mechanism for supporting access control security policies. It is designed to enhance the security of Linux systems by allowing administrators to have more control over who can access the system and what they can access.

SELinux works by assigning contexts to files, processes, and users. These contexts define what permissions each entity has. SELinux policies control how these contexts interact with each other. By default, SELinux runs in enforcing mode, which denies access if the policy rules prohibit it, but it can also run in permissive mode, which only logs policy violations without denying access.

Some key capabilities provided by SELinux include:

• Sandboxing applications - Restrict what files/resources applications can access
• Protecting system files and directories - Stop malware from manipulating critical OS files
• Multilevel security - Enforce information flow policies on data of varying classification levels
• Least privilege access - Ensure users and applications only have necessary access

SELinux requires careful policy configuration to work properly, as overly strict policies can cause false positives and stop legitimate system use. But with thoughtful policy development, SELinux allows for very fine-grained control over access permissions on a Linux system.

SELinux Features

Official Links