Learn SELinux - Modern Features & Roadmap

#Introduction

After automating the whole policy lifecycle in episode 20, there's a fair question: where is SELinux heading next? The answer is in the latest userspace release. In this episode 21, we dissect SELinux userspace 3.11, released in July 2026 — new features directly useful for CI and daily operations, important security fixes, and the roadmap for the next release. This is also preparation before episode 22, the finale of this series, where we tie together all the story threads.

#Main Discussion

#Userspace 3.11 Release at a Glance

SELinux consists of two worlds: the kernel, which enforces decisions, and the userspace, which composes, loads, and manages the policy. Release 3.11 is the collection of userspace tools and libraries (libselinux, libsepol, policycoreutils, SETools, and others) that are the everyday language of admins. Because userspace releases run on roughly a yearly rhythm, 3.11 is the "annual fix package" you must install.

#secilcheck: Validating Neverallow Without Source

The most interesting feature for automation is secilcheck. Up until now, validating neverallow rules — rules that forbid certain access combinations — required a full policy with the source tree. secilcheck does that directly against the binary policy already installed:

secilcheck -c /etc/selinux/targeted/policy/policy.33 myapp.cil

How to read it: give -c for checking mode, the path to the binary policy, and the CIL file containing the neverallow rules you want to verify. If there's a violation, secilcheck reports it with a non-zero exit code — exactly what the CI pipeline from episode 20 needs.

#Security Fixes: libselinux, dbus, and mcstrans

Every userspace release also brings security fixes, and 3.11 is no exception. Three areas worth noting:

• libselinux — the core library of all tools; fixes here touch the entire ecosystem.
• dbus — integration with the system bus used by many management tools.
• mcstrans — the daemon translating MLS contexts into a readable form; fixes here protect systems with an MLS policy.

Included among them are fixes for CVE-2026-59676 and CVE-2026-59677 (denial of service on seunshare) that you already know from episode 19. If you skipped the 3.10 to 3.11 upgrade for any reason, this is the strongest reason to do it now.

#restorecon -F: Reset Contexts in the Foreground

restorecon is the go-to tool for fixing labels. In 3.11, using -F becomes friendlier to scripting: the process runs in the foreground, so its exit code is reliable for automation. The function of -F itself stays the same: forcing a context reset even on files whose labels are already correct — useful when the policy changes and old labels no longer fit:

restorecon -F -Rv /var/www/myapp

fixfiles -F onboot

A simple analogy: restorecon -R is like putting a new label sticker only on files whose sticker has come off; -F puts a new sticker on everything without asking whether the old sticker is still attached. For the "new policy, labels changed a lot" case, -F is the right choice.

#setfiles -A and -U

setfiles is the high-performance relabel engine used by fixfiles and the boot process. Release 3.11 adds the -A and -U options for finer control in special scenarios:

• -A — controls how labels are associated with file context specifications, useful when you're fixing labels from a rescue environment that doesn't yet have the full context.
• -U — sets the user mapping in contexts during the relabel process, relevant for systems with an MLS policy and many users.

Its practical use in a recovery environment:

mount /dev/sda1 /mnt
setfiles -F -A -U system_u -r /mnt /etc/selinux/targeted/contexts/files/file_contexts

#Modern Python Support

For those of you automating SELinux through scripts, 3.11 brings good news: the tools and Python bindings now support modern Python versions (3.11 and up). This means SETools and other tooling can run on the latest distributions and pipelines without version hacks. The practical effect: the policy analysis scripts in CI from episode 20 won't be left behind by ever-rising Python versions.

#Roadmap: Kernel, Userspace, and the Next Release

SELinux is not a project that stops. The community-agreed roadmap covers three directions:

• CI improvements. Userspace test infrastructure keeps getting better so releases are more thoroughly tested across many kernel and distro combinations.
• Future policy format. There's active discussion about a better policy shape — a direction that will change how modules are written, while maintaining compatibility.
• Kernel and userspace collaboration. Since kernel SELinux is an active part of mainline LTS, development runs in tandem: userspace features appear backed by already-stable kernel support.

The release rhythm follows the habit: roughly once a year, with 3.12 expected in 2027. That means you don't need to anticipate surprising big changes — just make userspace upgrades part of routine maintenance, like kernel updates.

#Concrete Steps: Updating the Userspace

dnf update libselinux libsepol policycoreutils setools-console

apt update && apt install --only-upgrade libselinux1 policycoreutils setools

After the upgrade, verify that the policy is still valid and SELinux is still active:

sestatus
restorecon -Rv /etc /usr/sbin

#Closing

In this episode 21, you've seen SELinux as a living project: userspace 3.11 brings secilcheck for neverallow validation in CI, scripting-friendly restorecon -F, the setfiles -A and -U options for recovery, modern Python support, and — not to be missed — security fixes including CVE-2026-59676 and CVE-2026-59677. The roadmap is clear: regular roughly-annual releases, active collaboration with the kernel, and 3.12 waiting in 2027.

Key points to take home:

• secilcheck makes neverallow validation run in CI without the full policy source.
• Userspace upgrades are part of routine maintenance — not an occasional event.
• restorecon -F -Rv is the answer for outdated labels; fixfiles -F onboot for a full relabel.
• setfiles is reserved for recovery; don't use it without understanding the risks.
• SELinux stays active in the LTS kernel, with userspace releases about once a year.

At this point, all the material is complete. In episode 22 — the finale of the Learn SELinux series — we'll compare SELinux with other security ecosystems, recap the whole journey from episode 0 to 21, and close with a production checklist and learning resources. See you there!