SELinux
also: Security-Enhanced Linux
SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) system that enforces fine-grained security policies beyond traditional file permissions, controlling what processes and users can access on the system.
SELinux adds a security layer on top of standard Linux permissions by implementing mandatory access control. Rather than just checking user/group ownership, SELinux evaluates every access request against a detailed policy that defines allowed interactions between subjects (users and processes) and objects (files, sockets, etc.).
Each file and process is assigned a security context consisting of a user, role, type, and level. For example, a web server process might have context system_u:system_r:httpd_t:s0. SELinux policies explicitly permit or deny access based on these contexts, following the principle of least privilege—only explicitly allowed actions are permitted.
SELinux operates in three modes: enforcing (blocks denied access), permissive (logs denials but allows them), and disabled. You can check the current mode with getenforce and manage contexts with tools like semanage, chcon, and restorecon.
Common in enterprise Linux systems (RHEL, CentOS, Fedora), SELinux significantly hardens security against privilege escalation and unauthorized access, though it requires careful policy configuration to avoid breaking legitimate applications.