title: SELinux
description: 'SELinux is a feature of the Linux kernel which can be

    used to guard against misconfigured or compromised programs.

    SELinux enforces the idea that programs should be limited in what

    files they can access and what actions they can take.

    <br /><br />

    The default SELinux policy, as configured on Red Hat Enterprise Linux 9, has been

    sufficiently developed and debugged that it should be usable on

    almost any system with minimal configuration and a small

    amount of system administrator training. This policy prevents

    system services - including most of the common network-visible

    services such as mail servers, FTP servers, and DNS servers - from

    accessing files which those services have no valid reason to

    access. This action alone prevents a huge amount of possible damage

    from network attacks against services, from trojaned software, and

    so forth.

    <br /><br />

    This guide recommends that SELinux be enabled using the

    default (targeted) policy on every Red Hat Enterprise Linux 9 system, unless that

    system has unusual requirements which make a stronger policy

    appropriate.'
warnings: []
requires: []
conflicts:
- apparmor
values:
- var_selinux_policy_name
- var_selinux_state
groups:
- selinux-booleans
rules:
- coreos_enable_selinux_kernel_argument
- grub2_enable_selinux
- package_libselinux_installed
- package_mcstrans_removed
- package_policycoreutils-python-utils_installed
- package_policycoreutils_installed
- package_setroubleshoot-plugins_removed
- package_setroubleshoot-server_removed
- package_setroubleshoot_removed
- selinux_all_devicefiles_labeled
- selinux_confinement_of_daemons
- selinux_policytype
- selinux_state
- selinux_user_login_roles
platform: machine
platforms: !!set
    machine: null
inherited_platforms: !!set {}
cpe_platform_names: !!set
    machine: null
documentation_complete: true
