--- title: What is SELinux? | daily.dev description: An explainer on SELinux, the mandatory access control system originally built by the NSA and Red Hat, covering its history, how it relates to Discretionary... canonical: https://daily.dev/posts/what-is-selinux--hqxgbtr8l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What is SELinux? | daily.dev og:description: An explainer on SELinux, the mandatory access control system originally built by the NSA and Red Hat, covering its history, how it relates to Discretionary... og:url: https://daily.dev/posts/what-is-selinux--hqxgbtr8l og:image: https://api.daily.dev/og/posts/HqXgBtR8l.png og:image:alt: What is SELinux? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What is SELinux? **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary An explainer on SELinux, the mandatory access control system originally built by the NSA and Red Hat, covering its history, how it relates to Discretionary Access Control, Linux Security Modules, and Extended File Attributes. It walks through SELinux contexts (user:role:type:level), its three operating modes (enforcing, permissive, disabled), commands for checking and changing status, and a real-world example of diagnosing and fixing an SSH permission denial caused by a mislabeled authorized_keys file using audit logs, semanage, chcon, and restorecon. It closes with a comparison to alternatives like AppArmor and SMACK. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is SSH login failing with permission denied even though file permissions on authorized_keys look correct? SELinux may be blocking sshd from reading the authorized_keys file due to an incorrect security label, even when standard Unix file permissions are fine. Checking audit logs with 'ausearch -m AVC --start recent' can reveal an AVC denial showing sshd_t was denied read access because the file had the wrong context (e.g. httpd_log_t instead of ssh_home_t). Running 'restorecon -R -v ~/.ssh' relabels the files to the correct default context and resolves the issue. _Developers debugging mysterious SELinux-related access denials can find troubleshooting guides like this through daily.dev._ ### What is the difference between SELinux enforcing, permissive, and disabled modes? Enforcing mode applies all SELinux rules and blocks unauthorized access; permissive mode checks rules and logs violations without blocking anything, which is useful for debugging; disabled mode turns SELinux off entirely. Mode can be checked with 'getenforce' or 'sestatus', changed temporarily with 'setenforce 1', or made permanent by editing SELINUX= in /etc/selinux/config. _Sysadmins weighing SELinux configuration tradeoffs can track practical Linux security explainers via daily.dev._ ### How does SELinux differ from Discretionary Access Control in Linux? Discretionary Access Control (DAC) relies on standard Linux users, groups, and file permissions, where the root user has unrestricted access and users can freely share permissions with others, creating security risks. SELinux adds Mandatory Access Control on top of DAC via Linux Security Modules, restricting even root processes to their assigned domain and enforcing granular label-based rules that a user cannot simply override. _Engineers comparing Linux access control models can follow deeper security breakdowns through daily.dev._ ## Similar posts on daily.dev - [Day 200 — Understanding SELinux File and Process Contexts on Ubuntu and Red Hat Linux](https://daily.dev/posts/day-200-understanding-selinux-file-and-process-contexts-on-ubuntu-and-red-hat-linux-zjzmvthrq) · Medium · 0 upvotes · 0 comments - [Tier list of Linux security mechanisms](https://daily.dev/posts/tier-list-of-linux-security-mechanisms-62renvfbz) · Lobsters · 3 upvotes · 0 comments - [Android Architecture & Security Model: TEE, Verified Boot, and SELinux](https://daily.dev/posts/android-architecture-security-model-tee-verified-boot-and-selinux-bytgusgtd) · Medium · 0 upvotes · 0 comments - [Linux Capabilities Revisited](https://daily.dev/posts/linux-capabilities-revisited-34qqueksc) · Hacker News · 0 upvotes · 0 comments - [Software sandboxing: The basics \(2025\)](https://daily.dev/posts/software-sandboxing-the-basics-2025--auazxdqh6) · Lobsters · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/what-is-selinux--hqxgbtr8l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What is SELinux?","url":"https://daily.dev/posts/what-is-selinux--hqxgbtr8l","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-is-selinux--hqxgbtr8l"},"datePublished":"2026-08-23T12:19:17.767Z","dateModified":"2026-08-23T12:35:18.106Z","description":"An explainer on SELinux, the mandatory access control system originally built by the NSA and Red Hat, covering its history, how it relates to Discretionary...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-is-selinux--hqxgbtr8l","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,ssh","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"What is SELinux?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-is-selinux--hqxgbtr8l#faq","mainEntity":[{"@type":"Question","name":"Why is SSH login failing with permission denied even though file permissions on authorized_keys look correct?","acceptedAnswer":{"@type":"Answer","text":"SELinux may be blocking sshd from reading the authorized_keys file due to an incorrect security label, even when standard Unix file permissions are fine. Checking audit logs with 'ausearch -m AVC --start recent' can reveal an AVC denial showing sshd_t was denied read access because the file had the wrong context (e.g. httpd_log_t instead of ssh_home_t). Running 'restorecon -R -v ~/.ssh' relabels the files to the correct default context and resolves the issue. Developers debugging mysterious SELinux-related access denials can find troubleshooting guides like this through daily.dev."}},{"@type":"Question","name":"What is the difference between SELinux enforcing, permissive, and disabled modes?","acceptedAnswer":{"@type":"Answer","text":"Enforcing mode applies all SELinux rules and blocks unauthorized access; permissive mode checks rules and logs violations without blocking anything, which is useful for debugging; disabled mode turns SELinux off entirely. Mode can be checked with 'getenforce' or 'sestatus', changed temporarily with 'setenforce 1', or made permanent by editing SELINUX= in /etc/selinux/config. Sysadmins weighing SELinux configuration tradeoffs can track practical Linux security explainers via daily.dev."}},{"@type":"Question","name":"How does SELinux differ from Discretionary Access Control in Linux?","acceptedAnswer":{"@type":"Answer","text":"Discretionary Access Control (DAC) relies on standard Linux users, groups, and file permissions, where the root user has unrestricted access and users can freely share permissions with others, creating security risks. SELinux adds Mandatory Access Control on top of DAC via Linux Security Modules, restricting even root processes to their assigned domain and enforcing granular label-based rules that a user cannot simply override. Engineers comparing Linux access control models can follow deeper security breakdowns through daily.dev."}}]} ```