---
title: SELinux
kind: note
description: Link Mandatory Access Control system and policies for Linux operating systems, originally developed by the NSA and Red Hat and released in 2000 . For every current user or process, SELinux assigns a…
words: 199
readingMinutes: 1
created: '2024-07-25T00:00:00.000Z'
updated: '2024-08-19T18:35:41+02:00'
website: https://selinuxproject.org/
---
## Link

<https://selinuxproject.org/>

- Mandatory Access Control system and policies for [Linux](/notes/linux) [operating systems](/notes/operating-systems), originally developed by the [NSA](/notes/nsa) and <span class="dead-link">Red Hat</span> and released in <span class="dead-link">2000</span>.
- > For every current user or process, SELinux assigns a three string context consisting of a username, role, and domain (or "type").
- > The command `runcon` allows for the launching of a process into an explicitly specified context (user, role, and domain), but SELinux may deny the transition if it is not approved by the policy.
- > After running in permissive mode for a while, the `audit2allow` tool can be used to produce additional rules that extend the policy to allow all legitimate activities of the application being confined.
- The default policy on [RHEL](/notes/red-hat-enterprise-linux) is "targeted", meaning it only confines certain applications (e.g. daemons) and leaves others (e.g. the shell) running unrestricted.
## Resources
- [GitHub](https://github.com/SELinuxProject)
- [Wikipedia](https://en.wikipedia.org/wiki/Security-Enhanced_Linux)
- [What is SELinux?](https://www.redhat.com/en/topics/linux/what-is-selinux) - introductory article
- [Using SELinux](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/using_selinux/index) - from [RHEL](/notes/red-hat-enterprise-linux) 9 documentation
- [SELinux User's and Administrator's Guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/index) - from [RHEL](/notes/red-hat-enterprise-linux) 7 documentation
- [SELinux troubleshooting and pitfalls](https://www.redhat.com/sysadmin/selinux-troubleshooting)
- [SELinux as a security pillar of an operating system - Real-world benefits and examples](https://access.redhat.com/articles/6964380)
## FAQ
### Show the security context of processes or files
```shell
ls -Z
ps -Z
```
### Set to permissive mode to allow (but log) policy violations
Edit `/etc/selinux/config`:
```text filename=/etc/selinux/config
SELINUX=permissive
```
```shell
sudo reboot
```
### Verify SELinux status
```shell
sestatus
```