Alternatives to SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
Replacements
Listings that take over the same core job as SELinux.
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
AppArmor confines programs with per-application profiles in the mainline kernel, which many find simpler to write than SELinux's mandatory access control policy.
Similar software
Related functionality, not a direct replacement.
Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
USBGuard
A Linux framework that allows or blocks USB devices according to rules you write.
Kicksecure
Hardened Debian derivative with kernel hardening and exploit mitigations.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Lynis
Audit Unix-like systems for hardening opportunities.
