Don't Panic — SELinux

SELinux is a label-based mandatory access control system in the Linux kernel. It decides whether a process may perform a specific operation on a specific resource, and it does this even when ordinary Unix permissions would say yes. It is not an antivirus, not a firewall, and not a replacement for file ownership — it is a second gate that opens only when the policy says the source and target are allowed to talk.

The problem it exists to solve is straightforward: a web server process runs as a single Unix identity that can read many files. If that server is compromised, the attacker inherits the same broad access. Before SELinux, the only way to narrow that access was application-level sandboxing or chroot, both of which are fragile. SELinux gives the kernel a policy that confines each service to exactly the types of resources and operations it actually needs.

Three ideas carry everything else. First, labels. Every process has a type — called a domain — and every file, socket, and port carries a type label. The kernel compares these labels against the loaded policy to decide each access. Second, deny by default. An operation needs an explicit allow rule; if no rule matches, the kernel denies it. Third, the Access Vector Cache, or AVC, stores recent decisions so the same policy lookup does not repeat on every system call.

The surprise for most newcomers is that labels are stored as extended attributes on files, not derived from paths. Moving a file can preserve a label that does not fit its new location, and the kernel will still enforce the old policy relationship. The practical lesson: check matchpathcon before writing policy, because the current label might simply be wrong rather than evidence that a new rule is needed.

Start with the Intro for the full access-decision flow and the glossary. Slides compress the relationships into a visual map. Cheatsheet is the command reference you will reach for during diagnosis. Field Notes covers where the operational costs hide. The quiz checks the distinctions that trip up every team.

Don't Panic — SELinux

Relevant careers