openskills.info
Course catalog
SELinux logoCourse Preview

SELinux

SELinux is a Linux kernel security system that labels processes and resources, then applies mandatory policy to decide which interactions are allowed. It limits what a process can do even when ordinary Unix permissions would allow more.

itLinux

SELinux

Security-Enhanced Linux, or SELinux, is a mandatory access control system in the Linux kernel. It labels processes and resources with security contexts. Loaded policy then decides whether a labeled process may perform a specific operation on a labeled resource.

SELinux adds a control layer after traditional discretionary access control. Unix ownership, mode bits, and access control lists still apply. If those controls deny an operation, SELinux does not need to evaluate it. If they allow the operation, SELinux can still deny it.

The practical goal is containment. A web server process may run as a service account that can read many files. SELinux policy can confine that process to the types and operations required for serving content. A compromised process then remains inside a smaller boundary than its Unix identity alone would provide.

The access decision

Follow one request through the system:

  1. A process in a source domain requests an operation, such as reading a file or binding a port.
  2. The target object carries a type, and the operation belongs to an object class, such as file or tcp_socket.
  3. Traditional Unix access checks run first.
  4. The SELinux security server consults the loaded policy for the source type, target type, class, and permission.
  5. The Access Vector Cache, or AVC, stores recent decisions to avoid repeating the same policy lookup.
  6. The kernel allows the operation only when every applicable control permits it.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources