SELinux is the mandatory access control (MAC) built into the Linux kernel: where classic Unix permissions let the owning user decide, SELinux decides according to a global policy, independent of file permissions. Enabled by default on AlmaLinux, it calls for a different mindset — and learning it in the field sometimes starts with breaking something.
Containing a risky user
First concrete case: preventing an external user from executing scripts from directories they can write to. SELinux's answer comes through roles. Assigning a user to the staff_u role (instead of the default unconfined_u) shrinks their scope of action without changing a single filesystem permission. The Boolean staff_exec_content off then forbids that role from executing content in any directory it can write to — /tmp included.
What would have required a sandbox or complex rules gets solved in two commands:
sudo setsebool -P staff_exec_content off
When hardening backfires
The second case is less expected: after applying the containment, the graphical interface refused to start. The policy was so strict that the processes responsible for displaying the desktop were also blocked by SELinux.
Recovering meant switching to pure console mode (Ctrl+Alt+F2), temporarily setting SELinux to Permissive mode (setenforce 0) so the system would stop blocking while still logging, then analyzing the AVC alerts with ausearch to pinpoint exactly what was being denied.
What SELinux teaches you to think
Working with SELinux forces you to reason in terms of security identity — the context of a file or process — rather than in terms of permissions. A file can be readable but not executable depending on its SELinux type, regardless of its chmod. It's a level of granularity that doesn't forgive guesswork, but that offers a dramatically reduced attack surface once mastered.
| Concept | Purpose |
|---|---|
| Labels (Contexts) | Define a file's security identity (e.g. tmp_t) |
| Booleans | Let you tweak policy on the fly without rebooting |
| Ausearch | The essential tool for reading AVC alerts and understanding denials |
