selinux-knowledge-patch

SELinux Knowledge Patch

Read the relevant reference before changing SELinux policy, relabeling a filesystem, configuring container confinement, enabling a distribution policy, or administering MLS. Policy availability, boot activation, relabel behavior, and MLS recovery paths differ materially by platform and policy type.

Reference index

Reference	Topics
Userspace tools and relabeling	Removed interfaces, secilcheck, CIL conversion, xperms, restorecon, setfiles, restorecond, mcstrans, and build workflow
Container policy	Udica templates, Incus, overlay transitions, ptrace control, nested containers, and confined identities
RHEL MLS	MLS activation, SSH administration, clearances, secure terminals, file sensitivity, and separation of duties
Distribution policy and activation	openSUSE defaults, SLE Micro policy and relabeling, SLES policy availability, and boot selection

Breaking and removed userspace interfaces

Replace removed process-kill options

sandbox and seunshare no longer accept -k or --kill. Use killall -Z when process selection by SELinux context is required. Do not preserve the old switches in scripts as compatibility aliases.

Remove legacy policy syntax

checkpolicy no longer accepts the legacy fscon statement. Migrate policy sources instead of attempting to enable a compatibility mode.

Require Python 3 for audit tooling

audit2why no longer supports Python 2. Package and invoke it with Python 3.

Emit valid CIL class permissions

A CIL classperm declaration must contain at least one permission. Treat an empty declaration as invalid input rather than a harmless no-op.

Start with the safety constraints

Before changing a host, identify all four of these:

1. The distribution and release.
2. The installed policy type, such as targeted or mls.
3. Whether the system is enforcing, permissive, or disabled.
4. Whether a complete relabel and reboot are acceptable.

Do not assume that installed SELinux binaries imply an installed or supported policy. Do not enable enforcing mode immediately after changing policy type or re-enabling SELinux. Relabel first, inspect denials in permissive mode, and only then enforce.

Relabel safely

Guard files with multiple hard links

Library callers can pass SELINUX_RESTORECON_SKIP_MULTILINK to make selinux_restorecon(3) refuse to relabel files with multiple hard links. restorecond always applies this protection because a pathname in a watched location such as a home directory or /tmp may be a link to another inode.

setfiles -A has a different purpose: it disables SELINUX_RESTORECON_ADD_ASSOC. Do not describe -A as the switch that enables the multiple-link guard.

Account for path resolution

When /proc is available, selinux_restorecon(3) operates through /proc/self/fd paths; otherwise it falls back to full paths. Without SELINUX_RESTORECON_REALPATH, it follows no symlinks. With that flag, the initial path can still canonicalize intermediate symlinks.

Audit command-line and configured paths containing intermediate symlinks when behavior differs among setfiles, restorecond, sandbox, and seunshare. Do not infer identical resolution semantics merely because all use libselinux.

Continue across read-only filesystems

restorecon logs an error and continues when a traversal encounters a read-only filesystem. This matters for walks crossing read-only Btrfs subvolumes: inspect the error, but do not assume the entire walk stopped.

Run restorecond in the foreground

Use foreground mode when supervising restorecond directly:

restorecond -F

The system service uses this mode, so custom service definitions should not expect the daemon to fork itself.

Validate and convert policy

Use secilcheck to check CIL neverallow rules against a compiled binary policy. This is distinct from merely compiling the CIL source.

When diagnosing generated policy, account for corrected conversion behavior:

• Module-to-CIL conversion emits constrain and validatetrans unless a constraint contains a level-based expression.
• It distinguishes tunableif from booleanif and omits empty conditional blocks.
• CIL-to-policy.conf conversion handles constraint name lists correctly.
• Xperm permission linking, out-of-range values, and complements at range boundaries are handled correctly.

Regenerate policy before hand-editing output that was produced to work around older conversion behavior.

Apply container policy deliberately

Prefer generated least-privilege policy for host mounts

The default SLE Micro container policy denies access to files outside container data, including bind-mounted host paths, while allowing all network access. Use Udica with container inspection JSON, install the generated modules, and start the container with the generated type via --security-opt.

Container policy packages can carry deployable Udica templates. This permits Udica-generated policy to be installed on OpenShift nodes without installing Udica on every node.

Check runtime-specific support

Current container policy supports Incus-managed containers. Its supplied container_contexts also supports containers running inside containers.

For overlay-containers and overlay2-containers, directory transitions label new directories container_ro_file_t; they should not inherit data_home_t merely because of where they were created.

Honor global ptrace restrictions

Ptrace permission for container_runtime_domain is conditional on deny_ptrace being false. Enabling deny_ptrace therefore restricts runtime domains as well as the other domains governed by that boolean.

On systems with confined SELinux users, use the installed container_u identity description for container workloads.

Activate RHEL MLS conservatively

RHEL 10 MLS has no unconfined module: even root remains confined. Do not use this MLS policy on a system running the X Window System. Users created under a different SELinux policy cannot simply be reused under MLS.

Install and activate MLS from permissive mode, request a complete on-boot relabel, reboot, and inspect denials:

dnf install selinux-policy-mls
# Set SELINUX=permissive and SELINUXTYPE=mls in /etc/selinux/config
fixfiles -F onboot
reboot
ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i

If remote administration is required, enable ssh_sysadm_login before the first MLS boot. After MLS is active, a root login in staff_r must enter sysadm_r with newrole -r sysadm_r before changing that boolean.

Manage MLS clearances precisely

An SELinux user's default level and allowed range are separate settings. After changing them, regenerate home-directory contexts, restore those contexts, set the login mapping's level, and relabel the individual home.

semanage user -m -L s1 -r s1-s15 staff_u
genhomedircon
restorecon -R -F -v /home/
semanage login -m -r s1 example_user
chcon -R -l s1 /home/example_user

newrole -l starts a nested shell. A single level changes the lower bound of the current range, so changing s0-s2 to s1 yields s1-s2; exit returns to the prior shell. It works only on terminal types listed in /etc/selinux/mls/contexts/securetty_types. SSH is not secure by default, so add its tty type only after assessing the risk.

Make MLS file levels persistent

Membership in mlsfilewrite lets selected domains write below their current lower clearance bound by promoting the file to that lower bound:

(typeattributeset mlsfilewrite (staff_t))

This automatic promotion is not a persistent file-context rule; restorecon can revert it. For a durable sensitivity, configure the range and restore it:

semanage fcontext -a -r s2 /path/to/file
restorecon -F -v /path/to/file

Preserve an MLS security-administration path

The enabled sysadm_secadm module grants policy-administration rights to sysadm_r. Before disabling it, provision a reachable staff_u account whose sudo rule enters secadm_r. Use semodule -d sysadm_secadm; do not use semodule -r, which deletes the packaged module and requires reinstalling the MLS policy package to recover it.

Verify distribution policy availability

• New openSUSE Tumbleweed ISO installations select enforcing SELinux by default, and minimalVM images enable it. Installer choice controls this; existing systems are not switched automatically.
• SLE Micro 6.0 installs a supported targeted policy and supports boot-time relabeling with /etc/selinux/.autorelabel.
• SLES 15 SP7 supplies the framework, binaries, and libraries but no default policy. Production use requires a custom-built policy; use SLE Micro when a supplied supported policy is required.

For the exact boot arguments, relabel markers, and support boundaries, read Distribution policy and activation.