Allowed, Logged or Blocked?

About this interactive

On a Linux host with SELinux, every access is checked twice. First come the ordinary Linux permissions, which are discretionary: a file's owner decides who may read or write it. Then comes SELinux, which is mandatory: a central policy, written by IT or security, decides what each process may reach, and no owner can change it from her own files. SELinux can only narrow what the Linux permissions allow. If the permissions refuse an access, it fails there, and SELinux is never asked. If the permissions allow it, the SELinux mode decides what happens to anything the policy forbids. Enforcing: it is blocked, even for a service running as root. Permissive: it goes ahead and is written to the log, which makes permissive a dry run of what enforcing will block. Disabled: SELinux checks nothing and logs nothing, and the Linux permissions decide alone. To predict an outcome, take the Linux permissions first, then the policy, then the mode.

What you'll learn

Predict what happens to an access attempt on a Linux host from its SELinux mode, its Linux permissions and its SELinux policy
Apply the order of the two checks to a case: the Linux permissions first, then SELinux, which can narrow access but never grant what the permissions deny
Explain why an owner's permission change, or the root account, cannot get past an SELinux policy in enforcing mode, and why a permissive log is a list of what enforcing will block

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

Key terms

Security-enhanced Linux: Security-enhanced Linux is an implementation of Mandatory Access Control in the Linux kernel that enforces policy-driven access rules on processes and files, limiting damage from compromised applications.
Mandatory Access Control: An access control model in which the users of a resource cannot change its permissions themselves — anyone who needs access must obtain it from a designated authority, such as IT or whoever is put in charge of that resource. It is the opposite end of the spectrum from discretionary access control, where the resource's own users grant access at their discretion.
Discretionary Access Control: Discretionary Access Control is an access control model in which resource owners have the authority to grant or revoke access to their own resources, typically implemented through file system permissions and access control lists.

Topics

Security Enhanced Linux Mandatory Access Control Discretionary Access Control Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →