SELinux adds mandatory access control (MAC) to traditional Linux file permissions. When access is denied, audit logs and the security contexts of processes and files help identify the policy rule. Disabling SELinux conceals the symptom instead of fixing the underlying cause.
Simple definition
Technical definition
Security-Enhanced Linux (SELinux) uses labels and a security policy to restrict what processes can access, even when conventional Unix permissions would allow the action.
A mandatory access control mechanism used on several Linux distributions. Under Linux, this concept is part of the system administration, storage, services or host security.
How to resolve an SELinux denial
Review the audit log to identify the process domain, target type and denied operation. Correct an incorrect file context first, then review documented policy booleans. Consider a custom policy only when the requested access is legitimate and no existing rule applies.
What is SELinux used for?
Limit the impact of compromised processes and enforce access controls on services and resources.
Practical example
An administrator may troubleshoot a web service that cannot read a file because its SELinux context is incorrect.
How can you diagnose an SELinux denial?
Check the mode with getenforce or sestatus, reproduce the issue and inspect recent denials using ausearch -m AVC -ts recent. Inspect labels with ls -Z. If a file was moved or restored with an incorrect label, restorecon can restore its default context.
Common issues
Switching SELinux to permissive mode can help establish whether a denial comes from policy, but it is not a lasting remedy. Investigate file labels, booleans and policy rules, and verify standard Unix ownership and permissions too.
FAQ — SELinux
Does SELinux replace chmod and chown?
No. Traditional Unix permissions and SELinux policy are both evaluated; access must satisfy the applicable controls.
What does Enforcing mean?
In Enforcing mode, SELinux applies its policy and blocks prohibited operations, typically recording denials in audit logs.
What does restorecon do?
The restorecon command restores expected SELinux file contexts according to the installed policy, often correcting labels after file moves or restores.