← All tech

SELinux

kernel-featureopen source

A label-based Linux Security Module enforcing a comprehensive, system-wide mandatory access policy.

SELinux is a mandatory-access-control that labels every process and object and enforces a global, admin-defined policy over their interactions. It is the most comprehensive of the classic and the default MAC layer on Fedora/RHEL, where it confines containers (e.g. via container-selinux). Like AppArmor it is privileged and system-wide; policy is written by administrators, not self-imposed by an unprivileged application.

Strengths

  • Comprehensive label-based MAC covering the long tail of operations
  • Strong container confinement on RHEL/Fedora by default
  • Type enforcement contains a compromised process's reach

Limitations

  • Privileged, system-wide, and famously complex to author and debug
  • Policy is admin-defined, not application-self-imposed like Landlock
  • Shared kernel, hardens processes, does not provide a hardware boundary

Sources