What it means
SELinux policy enforcement uses labels, types, roles, and policy rules to confine processes and data even when conventional ownership and mode bits would permit access.
Why it matters
SELinux can contain compromised processes, but only when administrators diagnose policy, label, and boolean problems instead of disabling enforcement.
Practical focus
- Define the process and data domains that require mandatory confinement and the security outcome it must support
- Apply enforcing policy, correct labeling, and narrowly reviewed booleans or local rules through documented, reviewable configuration
- Verify access-vector denials, label drift, and enforcement-state changes after changes and on a scheduled basis
- Plan for a mislabeled resource interrupting service or a permissive workaround becoming permanent, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a mislabeled resource interrupting service or a permissive workaround becoming permanent as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: