SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About SELinux
SELinux confines what processes on a Linux system can do according to a security policy, enforced by features built into the Linux kernel. This project provides the userland side: libselinux, libsepol and libsemanage, the checkpolicy compiler, the CIL compiler, policycoreutils, restorecond, mcstrans and the sandbox tool.
Linux distributions ship these tools, so most administrators use them through their distribution's packages rather than building them from source. It suits people hardening servers or writing and managing access control policy.
Strengths
- Mandatory access control enforced by the kernel
- Complete set of policy compilers and management tools
- Shipped by Linux distributions
Limitations
- Linux only
- Writing and debugging policy has a steep learning curve
Details
- Pricing
- FreeFree and open source.
- License
- Open source, license not stated
- Developer
- The SELinuxProject contributors
- Platforms
- Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Linux administrators confining services with mandatory access control policy
- Categories
- Security tools, IT administration
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to SELinux
Compare allSoftware that can replace SELinux for an important use case, and what changes if you switch.
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
AppArmor confines programs with per-application profiles in the mainline kernel, which many find simpler to write than SELinux's mandatory access control policy.
Similar software
Related functionality, not necessarily a direct replacement.
Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
USBGuard
A Linux framework that allows or blocks USB devices according to rules you write.
Kicksecure
Hardened Debian derivative with kernel hardening and exploit mitigations.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Lynis
Audit Unix-like systems for hardening opportunities.
