Introduction to the Red Hat SELinux

Updated: 22 October 2026 · Applies to: SELinux on Red Hat Enterprise Linux and its derivatives (AlmaLinux, Rocky Linux)

SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) system built into the Linux kernel through Linux Security Modules. It was originally developed by the NSA, with SELinux's integration into Red Hat Enterprise Linux a joint effort between the NSA and Red Hat.

MAC versus DAC

Standard Linux permissions are Discretionary Access Control (DAC): whoever owns a file controls access to it, so a compromised process (such as Apache) can potentially do anything that file's owner can do, and a bug in software running as root can affect the whole system.

SELinux adds Mandatory Access Control (MAC) on top of that: every process and every file gets a security policy enforced by the kernel itself, independent of file ownership, so even a compromised or malicious process is restricted to what its policy allows.

How a decision gets made

When a process tries to access a file, the kernel's policy enforcement server first checks the access vector cache (AVC), which holds recently cached decisions. If there is no cached answer, it falls through to the security server, which looks up the security context of both the process and the file against the loaded policy, then grants or denies the request. A denial is logged to /var/log/messages as an avc: denied message.

Operating modes

• enforcing: the policy is enforced; denied actions are blocked.
• permissive: denials are logged but not blocked, useful for troubleshooting or developing a policy.
• disabled: SELinux is fully off, with its kernel hooks disengaged.

Configuration files

The main configuration file is /etc/sysconfig/selinux, editable directly or through the SELinux Administration Tool (system-config-selinux). Its key settings:

• SELINUX=enforcing|permissive|disabled: the top-level state, as above.
• SELINUXTYPE=targeted|strict: targeted protects only specific network daemons; strict applies full protection to every process and file on the system.
• SETLOCALDEFS=0|1: controls how local user and boolean definitions are applied; use 1 when they are set by load_policy, or 0 when managed by semanage.

Policy files themselves live under /etc/selinux/.

Common utilities

• setenforce: switches between enforcing and permissive mode immediately.
• sestatus -v: shows detailed SELinux status.
• newrole: starts a new shell under a different role or context.
• restorecon: resets the security context of one or more files to what the policy expects.
• fixfiles: checks or corrects security contexts across the file system.