Security-Enhanced Linux
Upstream repository for the Security Enhanced Linux (SELinux) userland libraries and tools, complementing the kernel's mandatory access control features.
What is Security-Enhanced Linux?
SELinux Userspace is the upstream repository for the userland libraries and tools that manage Security Enhanced Linux (SELinux). It provides the utilities and system libraries needed to configure, enforce, and analyze SELinux mandatory access control policies on Linux systems. This project complements the SELinux features integrated into the Linux kernel and is used by major Linux distributions.
Linux system administrators, security engineers, and distribution maintainers who need to implement and manage mandatory access control policies. It is also relevant for developers building security-sensitive applications that integrate with SELinux.
Developers choose SELinux Userspace because it is the authoritative, upstream source for SELinux userland components, ensuring compatibility and standardization across Linux distributions. It provides a comprehensive, tested set of tools and libraries for granular security policy management beyond standard Linux permissions.
Overview
This is the upstream repository for the Security Enhanced Linux (SELinux) userland libraries and tools. The software provided by this project complements the SELinux features integrated into the Linux kernel and is used by Linux distributions. All bugs and patches should be submitted to selinux@vger.kernel.org
Use Cases
Best For
- Enforcing mandatory access control policies on Linux servers
- Managing fine-grained security permissions in multi-user environments
- Integrating SELinux functionality into custom applications via libraries
- Automating security policy analysis and deployment with Python/Ruby scripts
- Developing and testing SELinux policies for custom Linux distributions
- Implementing security-hardened systems with granular access controls
Not Ideal For
- Small-scale or home lab environments where the administrative complexity of SELinux outweighs its security benefits
- Containerized deployments relying primarily on lightweight isolation like namespaces and seccomp, without mandatory access control needs
- Teams without dedicated security expertise to manage and troubleshoot policy violations effectively
- Projects requiring rapid prototyping or development where SELinux's strict enforcement could impede workflow
Pros & Cons
Pros
Serves as the canonical source for SELinux userland components across major Linux distributions, ensuring standardization and compatibility.
Provides utilities like policycoreutils and libraries (libselinux, libsepol) for full policy lifecycle management, from creation to enforcement.
Includes Python and Ruby bindings, enabling automation of SELinux operations through scripts, as supported by the build dependencies for swig and language dev packages.
Integrates OSS-Fuzz and CI-driven test suites, highlighted by badges in the README, to enhance code reliability and vulnerability detection.
Cons
Installing from source can overwrite system libraries and potentially render the system unusable, as warned in the README due to dependency mismatches.
Requires a long list of development packages on Fedora and Debian, making setup cumbersome and error-prone for new users.
Custom CFLAGS can easily break the build, as noted in the README, limiting flexibility in compilation environments and increasing maintenance overhead.
Frequently Asked Questions
Related Projects
VaultA tool for secrets management, encryption as a service, and privileged access management
How-to-Secure-A-Linux-ServerAn evolving how-to guide for securing a Linux server.
fail2banDaemon to ban hosts that cause multiple authentication errors
lynisLynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.