Learn SELinux - Pre-Requisite Skills & Environment Setup

#Introduction

Welcome to the Learn SELinux series! This series will take you from zero to production-ready in understanding SELinux (Security-Enhanced Linux) — a Linux Security Module that provides Mandatory Access Control (MAC) based on Type Enforcement. There are 23 episodes total that will guide you from understanding your first denial to managing secure, audited, and production-ready policies that can be used in the real world.

Before you type your first getenforce or read an AVC log containing denials, there are some basic skills and tools you need to have first. Why are these prerequisites so important? SELinux is not a standalone feature — it runs on top of the Linux foundation you already know: file permissions, systemd, package manager, and CLI. Imagine wanting to become an airplane pilot but not understanding how to read cockpit instruments — no matter how good the plane is, takeoff will still be difficult.

Episode 0 will be your roadmap: making sure your skills are sufficient, setting up a safe lab environment with a distro that has SELinux enabled, installing userspace tools, and then verifying that your system is ready. Once this episode is complete, you'll be truly ready to move on to episode 1, which covers the history and background of why SELinux exists.

#Essential Skills You Must Have

Let's start with skills. Without these skills, even the most sophisticated tools will be useless.

#Linux CLI & Shell (bash/zsh)

You will spend almost all of this series at the terminal. SELinux is managed through CLI commands such as semanage, sesearch, restorecon, and audit2allow — without comfort on the command line, all these tools will just feel like meaningless magic spells. Make sure you're comfortable with:

1. File navigation and operations — ls, cd, cat, grep, less, tail, and find.
2. Basic shell scripting — variables, loops, and | pipelines to combine small commands into one complex job.
3. Reading command output — because almost all SELinux tools print results to the terminal, and that's where you'll diagnose problems.

You don't need to become a script master. Just reach the level of "I can write commands, read output, and inspect errors without panicking". The rest will come naturally as you progress through this series.

#Service Management with systemctl

SELinux doesn't work alone — it depends heavily on the services underneath it, and almost all of those services are managed by systemd. You'll interact often with services like auditd, sshd, and httpd in the following episodes. Master these four basic operations:

One thing to note from now on: in the SELinux world, every service process runs in a domain — a term you'll encounter very often starting in episode 2. systemd and SELinux are two worlds that overlap, so understand both.

#File Permissions: chmod, chown, umask

This is the most important foundation. Before understanding SELinux's MAC (Mandatory Access Control), you need to understand first Linux's built-in DAC (Discretionary Access Control) — the rwx permissions for user, group, and other that you've been using with chmod and chown. Remember one principle: SELinux works on top of DAC, not replacing it. An access must pass through two layered gates: DAC first, then MAC.

chmod 750 /srv/www
chown arman:devops /srv/www
umask 022

chmod 750 means the owner has full access, the group can read and execute, and others have no access. umask 022 ensures new files aren't accidentally left wide open. If these concepts still feel unfamiliar, take some time to review Linux permission material before continuing — because in episode 1 we'll discuss why DAC alone is not enough for a truly secure system.

#Package Manager & Processes: dnf

This series focuses on the Red Hat ecosystem, so dnf will be your daily companion. You'll install SELinux userspace tools, update policy packages, and sometimes install additional policy packages for specific applications. Also, understand how to view processes with ps aux and kill processes with kill — because SELinux context labels attach to processes, not to commands.

#Setting Up a SELinux Lab Environment

Now that the basic skills are ready, it's time to set up the environment where you'll practice. This decision matters because it determines how representative your learning experience is of production conditions.

#Choosing a Distro with SELinux Enabled

SELinux is the most mature feature in the Red Hat ecosystem. Distro recommendations for this series, in order of preference:

• RHEL 9 or 10 — the most enterprise-grade option, exactly what's used in data centers.
• Rocky Linux / AlmaLinux — free, binary-compatible RHEL derivatives; the most balanced for learning.
• Fedora — the newest and fastest-evolving version; suitable if you want to experience the latest features.

It's important to understand: distros outside the Red Hat family such as Ubuntu and Debian use AppArmor by default, not SELinux. Enabling SELinux there requires additional configuration steps and isn't recommended for learning — focus on one ecosystem for consistency.

#A Safe Lab: VM & Snapshot

Best practice: never learn SELinux on your main host or on a production server. Use a Virtual Machine (VM). Inside the VM, you're free to switch the enforcing mode to permissive, relabel file contexts however you like, and even break the system to the point where it can't boot — and none of it will affect your main computer.

One habit that will save you a lot: create a snapshot before experimenting. A wrong label with chcon or a full relabel with fixfiles can render the system non-functional — and the snapshot is your undo button. If you break something, just restore it.

#Installing Userspace Tools

The kernel is just the enforcer; the tools for reading policies, changing contexts, and troubleshooting all live in the userspace packages. After a clean system install, install the following packages:

sudo dnf install -y selinux-policy-targeted policycoreutils-python-utils setools-console audit

Here's the role of each package — get to know them because they'll accompany you throughout this series:

After the install finishes, make sure the auditd service is running because SELinux denial logs are written through it:

sudo systemctl enable --now auditd

#Verifying the Installation

Time to make sure everything is ready. First, check the currently running SELinux mode:

getenforce

Output Enforcing means SELinux is active and blocking accesses not allowed by the policy. Next, view the full status:

sestatus

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Memory protection checking:     actual (secure)
Max kernel policy version:      34

Three lines you must pay attention to: SELinux status: enabled (the kernel is active), Loaded policy name: targeted (the loaded policy), and Current mode: enforcing (the mode currently running). If all three match the example above, your environment is officially ready.

#Common Pitfalls

1. Learning on a distro where SELinux isn't enabled. Ubuntu/Debian default to AppArmor; there, getenforce doesn't even exist. Make sure you're on an RHEL/Fedora-family distro.
2. Disabling SELinux because of denials. This is the step beginners take most often — and it's the most wrong. Denials are information, not enemies. Starting in episode 3 you'll learn to read and resolve them correctly.
3. Forgetting to create a snapshot. Experimenting with labels and policies without a snapshot is like skydiving without a backup parachute. Always snapshot first.
4. Relying on the GUI. SELinux is managed through the CLI. The sooner you're comfortable with the terminal, the sooner you'll master this series.
5. Skipping the userspace tools install. If semanage or sesearch aren't found, you haven't installed policycoreutils-python-utils and setools-console.

#Closing

In this episode 0, we've laid a solid foundation for the entire journey: making sure you master basic Linux skills (CLI, systemd, permissions, dnf), choosing a Red Hat-family distro with SELinux enabled, setting up a safe VM lab, installing userspace tools, and verifying that SELinux runs in enforcing mode.

Key points to take with you:

• SELinux is a MAC that works on top of DAC — the two are layered, not interchangeable.
• Use a Red Hat-family distro (RHEL, Rocky, AlmaLinux, Fedora) so SELinux is enabled from the start.
• Always learn in a VM with snapshots so you're free to experiment.
• Userspace tools (semanage, sesearch, audit2allow, ausearch) are your main weapons — make sure they're installed.
• Verify readiness with getenforce and sestatus.

Remember, the Learn SELinux series consists of 23 episodes that build on each other. Make sure your environment is ready, because in the next episode 1 we'll discuss the history, background, and why the world needs SELinux — from the limitations of DAC, how NSA together with Red Hat birthed this project in the early 2000s, to its integration into the Linux 2.6 kernel in 2003. Stay motivated, because the SELinux learning journey has only just begun!