TechKnowSurge

VideoSecurityFree

SELinux

SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) framework that adds a centrally managed security layer on top of Linux's default discretionary access control (DAC) permissions. It can be configured in disabled, enforcing, or permissive modes to control or monitor resource access.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

SELinux, short for Security-Enhanced Linux, is a kernel-level security framework designed to harden Linux systems by introducing mandatory access control (MAC) alongside the operating system's native permission model. Standard Linux uses discretionary access control (DAC), a relatively simple system in which file and directory owners determine access rights for users, groups, and all others across three basic permission types: read, write, and execute. While functional, DAC gives individual users considerable control over their own resources, which can create security gaps in environments requiring stricter governance. MAC, the model SELinux enforces, shifts that authority away from individual users and toward centrally defined security policies. These policies are typically established by IT leadership and applied uniformly across the system, meaning no user can grant or inherit access outside of what those policies permit. When both systems are active, Linux's DAC permissions are evaluated first, and SELinux policies are applied afterward as an additional enforcement layer, so a user must satisfy both sets of controls to gain access to a resource. SELinux supports three operational modes. Disabled turns off SELinux enforcement entirely. Enforcing mode actively blocks any access that violates defined policies, making it the appropriate choice for production environments where strict control is required. Permissive mode functions as a monitoring and auditing tool, logging policy violations without blocking access — useful for testing policies before full enforcement. Together, these modes give administrators flexible control over how aggressively SELinux is applied while maintaining visibility into potential security issues.

What you'll learn

Distinguish between Discretionary Access Control (DAC) and Mandatory Access Control (MAC) as they apply to Linux security
Identify the three operational modes of SELinux — disabled, enforcing, and permissive — and describe the function of each

What's covered

SELinux Overview

Linux Permissions Basics
- Users Groups Others
- Read Write Execute
- Discretionary Access Control
DAC vs MAC
- Owner Controls Access
- Central Authority Policies
- MAC More Secure
SELinux Purpose
- Hardens Linux Machines
- Implements Mandatory Access Control
- Processes After Linux Permissions
SELinux Modes
- Disabled Not Active
- Enforcing Blocks Unauthorized Access
- Permissive Logs Violations

Key terms

Discretionary Access Control: Discretionary Access Control is an access control model in which resource owners have the authority to grant or revoke access to their own resources, typically implemented through file system permissions and access control lists.
Media Access Control: A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Access Control: A security mechanism that restricts access to resources based on policies, roles, or identity.
Security-enhanced Linux: Security-enhanced Linux is an implementation of Mandatory Access Control in the Linux kernel that enforces policy-driven access rules on processes and files, limiting damage from compromised applications.
Least Privilege: A security principle that grants users and systems only the minimum access rights needed to perform their functions.

Topics

Selinux Mandatory Access Control Discretionary Access Control Linux Security Access Control Operating Systems

Transcript

What SELinux Is

One of the ways that we can harden a Linux machine is using SELinux. SELinux stands for security enhanced Linux.

Before we jump too far into SELinux, let's first take a look at Linux and how it behaves by default. The first thing we should understand is a little bit about Linux permissions. I'm not going to get real in depth into it — in fact, I'm not a big fan of Linux permissions in general, it doesn't get very detailed. You have the users, the groups, and other, other being everyone. For each of those groups you can grant them permission to read, write or execute. So it's very basic: there's pretty much nine little triggers here that we can turn on or off.

Discretionary Versus Mandatory Access Control

Linux permissions are a type of discretionary access control, or DAC. DAC is an access model that you can implement, and essentially DAC means that users with proper access control can pass access control onto another user — and in the case with Linux, it's the owner. So an owner of a file or a folder can then change what access there is for other members, for other groups, and so they're the ones that can go in there and change those permissions.

This is commonly compared to mandatory access control, or MAC, which is a much more secure method for implementing security with this. In this model, a central authority defines access policies based on predefined security labels.

So here is DAC. This is the owner of a Linux system and they created a file, so now they have control over who accesses this file. So it's discretionary — it's up to the person who owns this file, it's up to their discretion who they give access to. Hence the term discretionary access control.

Versus mandatory access control: there's some sort of higher level, maybe it's some sort of policies that are created, where there is a mandatory access control that everyone has to conform to, these policies and how they're enforced. So who comes up with the policies? IT directors, managers, execs, whoever comes up with these. That's how things are run from a permission perspective, and that's how things are enforced.

So a big part of SELinux really is implementing this mandatory access control instead of the native Linux permissions, which are discretionary access control. They still both get processed: first the Linux permissions get processed, and then after the Linux permissions get processed, then the SELinux permissions will be processed.

The Feature Set

I'm here on the wiki article for security enhanced Linux, and if I scroll down we can see some of the information on SELinux, but we see the features. There's a lot of features, and we're not going to get real granular into this and really understand this fully, but just understand that there's a lot of advantages with going with SELinux and how it's implemented. So we're implementing a greater level of security.

The Three Modes

When we implement SELinux, we can either disable it, which means it's not working; enforce it, which means that anything that the user is not allowed to access, it just won't access; and then we can also do permissive, which means that it goes into a logging mode. So it'll log if somebody accesses something that they're not supposed to according to SELinux. Now, of course, they still have to have access to it from a Linux permission perspective, but once they gain access to it, then this permissive will log. So those are the three settings for SELinux: to disable it, enforce it, or be permissive.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →