Learn Rocky Linux - SELinux & Mandatory Access Control

#Introduction

In the previous episode 13, you built the outer defense wall with the firewall. But one question remains unanswered: who protects the system from within — when a process has already gotten in, or when root itself makes a mistake? The answer is SELinux, and this episode will change how you think about Linux security.

SELinux is often seen as a bogeyman: many tutorials suggest setenforce 0 as the first solution to every problem. In this episode you'll learn to use SELinux as a security layer that actually gives you valuable information — and solve problems by working with SELinux, not against it.

#DAC vs MAC

#Access Control Models

Traditional Linux uses DAC (Discretionary Access Control) — the control you learned in episode 6. The file owner decides who can access it, and root has unlimited power. The problem: if a process is successfully exploited, it inherits all the rights of its owner — including root rights.

MAC (Mandatory Access Control) layers on top of DAC. SELinux enforces system-defined policies, regardless of the file owner's wishes or root's power. Even root is restricted by SELinux policy rules:

sestatus

getenforce

The key difference: DAC is "the owner may decide", MAC is "system policy forces everyone — including root".

#SELinux Modes

#Three Modes

getenforce

setenforce 1
setenforce 0

setenforce 0 moves to Permissive — useful for diagnostics, but don't make it a permanent habit.

#Boot Configuration

The default mode is stored in /etc/selinux/config:

cat /etc/selinux/config

The SELINUX=enforcing line sets the mode at every boot. For production, the right target is enforcing — not disabled.

#File Contexts and Policy

#Context Labels

Every file on an SELinux system has a context label — type information that determines how processes can interact with it. View it with ls -Z:

ls -Z /var/www/html/index.html

ps -efZ | grep httpd

A context looks like system_u:object_r:httpd_sys_content_t:s0 — the last part (the type) is what's most often relevant. A web server needs the httpd_sys_content_t type to be able to read files.

#Fixing Contexts

If a file has the wrong type, SELinux blocks access even when the DAC permissions are correct. Fix it with restorecon:

restorecon -Rv /var/www/html

chcon -t httpd_sys_content_t /var/www/html/index.html

restorecon restores labels according to the default policy. chcon changes them manually — but chcon changes don't survive a context restoration.

#Persistence with semanage fcontext

To make context changes permanent — especially for non-standard directories — use semanage:

semanage fcontext -a -t httpd_sys_content_t "/data/web(/.*)?"

restorecon -Rv /data/web

semanage fcontext -l | grep /data

With semanage fcontext, rules are stored in the policy — every subsequent restorecon will always apply the correct label.

#Booleans

#Adjusting Policy Behavior

Booleans are switches that change SELinux policy behavior without writing new rules — the official shortcut for allowing frequently needed access.

getsebool -a

getsebool -a | grep httpd

A real-world example: allowing httpd to make outbound connections (a proxy or integration pattern):

setsebool -P httpd_can_network_connect on

getsebool httpd_can_network_connect

-P makes the change permanent (stored in the policy). Without -P, the change only applies at runtime and is lost on reboot.

#SELinux Troubleshooting

#Ausearch and Sealert

When SELinux blocks something, it records it in the audit log. Two tools help you read it:

ausearch -m avc -ts recent

ausearch -m avc --start today

ausearch -m avc displays AVC (Access Vector Cache) events — SELinux access denials. The output includes the process, source and target types, and the reason for the denial.

For fix recommendations, sealert translates technical messages into suggestions:

sealert -a /var/log/audit/audit.log

#The Right Diagnostic Flow

When a service fails to read a file:

1. Check ausearch -m avc -ts recent to confirm an SELinux denial.
2. Identify the source and target types in the output.
3. If it's a file context issue, use semanage fcontext + restorecon.
4. If it's a behavior issue, find the relevant boolean and enable it with setsebool -P.
5. Avoid the setenforce 0 shortcut; use Permissive only temporarily to confirm the cause.

setenforce 0
# coba ulang operasi yang gagal, lalu kembali
setenforce 1

#Closing

In this episode 14, you understood SELinux on Rocky Linux: the difference between DAC and MAC, the three modes Enforcing, Permissive, and Disabled, context labels with ls -Z and fixing them via chcon, restorecon, and semanage fcontext, booleans with getsebool and setsebool -P, and troubleshooting with ausearch and sealert.

Key takeaways:

• SELinux is a MAC that restricts even root — a safety layer on top of DAC.
• The production target is enforcing; setenforce 0 is only for momentary diagnostics.
• A wrong file context is the most common cause of failures; fix it with restorecon.
• Use semanage fcontext for permanent labels on non-standard directories.
• Booleans change policy behavior without writing new rules.
• ausearch -m avc and sealert are the first source when investigating SELinux denials.

In the next episode 15, we will discuss SSH hardening and remote access — modern sshd configuration, ed25519 key-based authentication, tunneling with -L, -R, and -J, and hardening like fail2ban and user restrictions. Security from within is strong; now it's time to secure the front door!