Introduction to SELinux
Code Snippets
# Check current mode
getenforce
# Detailed status
sestatus
# Check RHEL version
cat /etc/redhat-release# Enforcing: policy applied, violations blocked
# Permissive: violations logged but not blocked
# Disabled: SELinux off (never use in production)
setenforce 0 # temp permissive
setenforce 1 # back to enforcingWelcome to the SELinux for System Admins course. SELinux stands for Security-Enhanced Linux — a Mandatory Access Control system developed by the NSA and released as open source in 2000. It was merged into the Linux kernel in the 2.6 series and is enabled by default on RHEL. SELinux enforces least privilege based on labels and policy rules. It adds a second security layer on top of traditional DAC permissions. Even if file permissions say chmod 777, SELinux can still deny access based on its policy. SELinux has proven its value against real CVEs: Log4Shell (CVE-2021-44228), Looney Tunables (CVE-2023-4911), and Grafana (CVE-2023-3128). In each case, SELinux confined the vulnerable process and limited the attack surface. Compliance frameworks like NIS2, DORA, CIS benchmarks, and DISA STIGs all recommend or require SELinux in enforcing mode.