What Is SELinux and How Do I Use It in Spinup (High-Risk)?
Security-Enhanced Linux (SELinux) is a mandatory access control system built into Linux. It enforces policies that restrict what users and services can do—helping prevent privilege escalation, misconfiguration exploits, and lateral movement in compromised systems.
In Spinup (High-Risk) environments, SELinux is enabled and set to Enforcing mode by default. This is required for meeting Yale’s security standards, including protections for high-risk data such as FERPA, HIPAA, and research subject to regulatory oversight.
Why SELinux Is Important in Spinup (High-Risk)
Containment: Limits what processes can access, even if compromised.
Least Privilege: Ensures services can only perform intended tasks.
Compliance: Supports NIST 800-171 and HIPAA-aligned system hardening.
Disabling SELinux is not permitted. Instead, administrators are expected to work with its policies to enable legitimate functionality.
SELinux Modes (Verify with getenforce)
Mode | Description |
|---|---|
Enforcing | SELinux denies unauthorized actions and logs them. (Default in High-Risk) |
Permissive | Logs policy violations but doesn’t block them. (Useful for testing only) |
Disabled | SELinux is off. (Not allowed in Spinup (High-Risk)) |
Common Tasks
Check SELinux status
getenforce
sestatusView SELinux denial logs
sudo ausearch -m avc -ts recentOr with sealert if available:
sudo sealert -a /var/log/audit/audit.logChange file context
sudo chcon -t httpd_sys_content_t /var/www/html/index.htmlRestore default file context
sudo restorecon -Rv /path/to/dirSet a boolean to permit a service behavior
sudo setsebool -P httpd_can_network_connect onRecommended Learning Resources
Resource | Description |
|---|---|
The official and most comprehensive reference for SELinux usage | |
Community-driven documentation from the core SELinux developers | |
A user-friendly SELinux overview with practical examples | |
Tips and real-world SELinux problem solving by a leading expert | |
In-depth technical background on SELinux and its architecture |
Related Articles
Need Help?
Email spinup@yale.edu
Post in the
#spinupchannel on Yale Slack
SELinux takes patience—but it’s worth learning. It’s one of the strongest tools available for securing Linux systems in high-assurance environments like Spinup (High-Risk).
Let me know if you'd like to break this into an “Intro” article and an “Advanced Use Cases” article (e.g., SELinux + Apache, Docker, or custom services).Here’s the updated version of the SELinux in Spinup (High-Risk) guide, now with modern, reliable, and relevant learning resources from official sources and widely respected platforms:
What Is SELinux and How Do I Use It in Spinup (High-Risk)?
Security-Enhanced Linux (SELinux) is a mandatory access control system built into Linux. It enforces policies that restrict what users and services can do—helping prevent privilege escalation, misconfiguration exploits, and lateral movement in compromised systems.
In Spinup (High-Risk) environments, SELinux is enabled and set to Enforcing mode by default. This is required for meeting Yale’s security standards, including protections for high-risk data such as PHI, CUI, and research subject to regulatory oversight.
Why SELinux Is Important in Spinup (High-Risk)
Containment: Limits what processes can access, even if compromised.
Least Privilege: Ensures services can only perform intended tasks.
Compliance: Supports NIST 800-171 and HIPAA-aligned system hardening.
Disabling SELinux is not permitted. Instead, administrators are expected to work with its policies to enable legitimate functionality.
SELinux Modes (Verify with getenforce)
Mode | Description |
|---|---|
Enforcing | SELinux denies unauthorized actions and logs them. (Default in High-Risk) |
Permissive | Logs policy violations but doesn’t block them. (Useful for testing only) |
Disabled | SELinux is off. (Not allowed in Spinup (High-Risk)) |
Common Tasks
Check SELinux status
getenforce
sestatusView SELinux denial logs
sudo ausearch -m avc -ts recentOr with sealert if available:
sudo sealert -a /var/log/audit/audit.logChange file context
sudo chcon -t httpd_sys_content_t /var/www/html/index.htmlRestore default file context
sudo restorecon -Rv /path/to/dirSet a boolean to permit a service behavior
sudo setsebool -P httpd_can_network_connect onRecommended Learning Resources
Resource | Description |
|---|---|
The official and most comprehensive reference for SELinux usage | |
Community-driven documentation from the core SELinux developers | |
A user-friendly SELinux overview with practical examples | |
Tips and real-world SELinux problem solving by a leading expert | |
In-depth technical background on SELinux and its architecture |
Related Articles
Need Help?
Email spinup@yale.edu
Post in the
#spinupchannel on Yale Slack