SELinux (Security-Enhanced Linux) is a mandatory access control system enabled by default on AlmaLinux and Rocky Linux — a significant difference from Ubuntu/Debian. Rather than disabling it (a common but security-reducing shortcut), this guide covers working with it correctly.
Why SELinux Exists
Standard Linux permissions (owner/group/other) control access based on identity. SELinux adds a second, independent layer that restricts what a process can do based on defined security policy — so even a process running as root is still constrained by SELinux policy, providing defense in depth against exploited vulnerabilities.
Checking SELinux Status
getenforcePossible values:
| Mode | Meaning |
|---|---|
| Enforcing | SELinux actively blocks policy violations (default, recommended) |
| Permissive | Violations are logged but not blocked (useful for testing/debugging) |
| Disabled | SELinux is completely off (not recommended) |
Temporarily Switching to Permissive Mode (For Testing)
sudo setenforce 0This is temporary and reverts on reboot — useful for confirming whether SELinux is actually the cause of an issue you're troubleshooting, without a permanent change.
Permanently Changing SELinux Mode
sudo nano /etc/selinux/configSELINUX=enforcingUnderstanding SELinux Contexts
ls -Z /var/www/htmlEvery file has an SELinux context (a label) in addition to standard permissions. Web content typically needs the httpd_sys_content_t type to be readable by Nginx/Apache.
Fixing Incorrect File Contexts
sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/mysite(/.*)?"
sudo restorecon -Rv /var/www/mysitesemanage fcontext defines the rule persistently; restorecon actually applies it to existing files.
Understanding SELinux Booleans
Booleans are toggleable policy settings for common scenarios without writing custom policy:
getsebool -a | grep httpdsudo setsebool -P httpd_can_network_connect 1-P makes the boolean change persistent across reboots.
Diagnosing SELinux Denials
sudo ausearch -m avc -ts recentShows recent SELinux denials (AVC = Access Vector Cache) — the first place to check when something "should" work based on standard permissions but doesn't.
Using sealert for Human-Readable Explanations
sudo dnf install setroubleshoot-server -y
sudo sealert -a /var/log/audit/audit.logTranslates cryptic AVC denials into plain-language explanations and suggested fixes.
Common Contexts for Web Hosting
| Context Type | Used For |
|---|---|
| httpd_sys_content_t | Static web content (read-only) |
| httpd_sys_rw_content_t | Web content the web server needs to write to (uploads) |
| httpd_sys_script_exec_t | CGI scripts |
Setting a Writable Directory for Uploads
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/mysite/uploads(/.*)?"
sudo restorecon -Rv /var/www/mysite/uploadsWhy Not Just Disable SELinux?
Disabling SELinux removes a meaningful security layer that specifically limits damage from compromised applications — the correct approach is understanding and correctly configuring contexts/booleans for your legitimate use case, not disabling the entire subsystem.
Common Errors
"Permission denied" despite correct chmod/chown — almost always an SELinux context mismatch; check with ausearch -m avc -ts recent.
Continue Reading
- How to Install Nginx on AlmaLinux/Rocky Linux
- How to Install Docker on AlmaLinux/Rocky Linux
- How to Harden SSH and Security on AlmaLinux/Rocky Linux
Browse more articles in AlmaLinux & Rocky Linux.
