How to Create SELinux on Linux Server: Step-by-Step Guide

Security is a crucial concern for Linux servers, especially those hosting critical applications and sensitive data. Administrators can create SELinux policies to enforce mandatory access control (MAC), restricting programs and users from performing unauthorized actions and adding an extra layer of protection beyond standard Linux permissions.

In this article, we’ll cover how to configure, manage, and create SELinux on a Linux server. You’ll learn prerequisites, installation, modes, policy management, troubleshooting common issues, and best practices. By the end, you’ll understand how to leverage SELinux to enhance the security of your Linux environment.

Prerequisites

Before enabling or configuring SELinux, ensure the following:

• A Linux server (CentOS, RHEL, Fedora) that supports SELinux.
• Root or sudo access for configuration.
• Basic knowledge of Linux file permissions and command-line operations.
• Backup of critical files before enforcing SELinux policies.

These prerequisites ensure a smooth setup without disrupting existing services.

What is SELinux and Why Use It?

SELinux is a kernel security module that enforces security policies defining what users, applications, and processes can access. Unlike discretionary access control (DAC), which relies on user permissions, SELinux implements mandatory access control (MAC) to enforce stricter rules.

Key benefits include:

• Preventing unauthorized file or system access.
• Mitigating the impact of compromised applications.
• Enforcing fine-grained security policies.
• Logging access denials for auditing and analysis.

SELinux is widely used in enterprise Linux distributions for enhanced server security.

Installing SELinux on Linux

SELinux (Security-Enhanced Linux) is a powerful security module that adds mandatory access control to Linux systems. Installing it enables advanced security features to protect your server from unauthorized access and enforce strict access policies.

• Check if SELinux is Installed

sestatus

If installed, it shows the current mode.

• Install SELinux Packages (if not installed)

sudo yum install selinux-policy selinux-policy-targeted policycoreutils -y   # CentOS/RHEL
sudo dnf install selinux-policy selinux-policy-targeted policycoreutils -y   # Fedora

• Enable SELinux

Edit /etc/selinux/config and set:

SELINUX=enforcing
SELINUXTYPE=targeted

• enforcing → SELinux enforces rules.
• permissive → Logs violations but doesn’t block actions.
• disabled → SELinux is turned off.

Restart the server to apply changes:

sudo reboot

SELinux Modes

• Enforcing Mode: Policies are applied and violations are blocked.
• Permissive Mode: Violations are logged but not enforced, useful for testing.
• Disabled Mode: SELinux is turned off.

Switch modes temporarily without rebooting:

sudo setenforce 1   # Enforcing
sudo setenforce 0   # Permissive
getenforce           # Check current mode

Understanding modes helps balance security and system compatibility.

Create SELinux Policies on Linux

SELinux (Security-Enhanced Linux) provides mandatory access control to enforce strict security rules on Linux systems. Creating SELinux policies allows administrators to control what users, applications, and processes can access, improving system security. Follow these steps to create SELinux policies effectively:

• Check Current SELinux Status

Before creating policies, verify SELinux is enabled:

sestatus

You should see SELinux status: enabled and Current mode: enforcing.

• Install Policy Tools

Install the SELinux management tools needed to create and manage policies:

On Ubuntu/Debian:

sudo apt install selinux-utils selinux-policy-dev policycoreutils -y

On CentOS/RHEL:

sudo yum install selinux-policy-devel policycoreutils -y

• Generate a Custom Policy Module

Use audit2allow to generate a policy module based on denied access logs:

grep denied /var/log/audit/audit.log | audit2allow -M mycustompolicy

This creates a .pp policy module file (mycustompolicy.pp).

• Install the Custom Policy Module

Load the new policy into SELinux:

sudo semodule -i mycustompolicy.pp

This applies the custom rules without requiring a system reboot.

• Verify the Policy

Check that the new policy is active and SELinux is enforcing it:

sudo semodule -l | grep mycustompolicy
sestatus

• Test the Policy

Perform the actions the policy is meant to control. Check /var/log/audit/audit.log for any further denials and adjust the policy if necessary.

Managing SELinux Policies

Managing SELinux policies allows administrators to control and fine-tune access permissions for users, processes, and applications, ensuring that your Linux server remains secure while enabling necessary functionality.

• View Current Policy

sestatus
sestatus -b   # View boolean settings

• Manage File Contexts

SELinux labels files with security contexts:

ls -Z /var/www/html

To set the correct context for web files:

sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html(/.*)?"
sudo restorecon -Rv /var/www/html

• Manage SELinux Booleans

Booleans toggle SELinux policy rules for services:

sudo getsebool -a | grep httpd
sudo setsebool -P httpd_can_network_connect on

This allows services like web servers to communicate as required without disabling SELinux.

Troubleshooting Common SELinux Issues

Troubleshooting SELinux helps resolve access and permission problems that may affect your Linux server. Knowing how to fix SELinux issues ensures your system remains secure while allowing legitimate applications and users to function properly.

• Access Denied Errors: Check /var/log/audit/audit.log or use ausearch.
• Fix File Context Issues:

restorecon -Rv /path/to/file

• Check Boolean Settings: Ensure required booleans are enabled for services.
• Audit2Allow: Generate custom policy modules to allow specific actions:

grep httpd /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp

These tools help maintain strict security without breaking functionality.

Conclusion

Creating SELinux on a Linux Server significantly enhances security by enforcing mandatory access controls and restricting unauthorized actions. By installing SELinux, configuring modes, managing policies, and following best practices, administrators can protect critical data and maintain system integrity effectively.

For advanced configurations, custom policy creation, and troubleshooting, always refer to the official SELinux documentation.