Administer > SA Core and component security > SELinux security policy for Agent

SELinux security policy

Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies. Even if you enable SELinux on the system, you must have the right permissions for the system's resources (files, ports and so on) for performing their tasks.

You can enable SELinux in one of the following modes:

  • Permissive: Does not block access to any resources. Logs all the access denied messages into /var/log/audit/audit.log.
  • Enforcing: Blocks access to all resources if permission is not explicitly granted. Logs all the access denied messages into /var/log/audit/audit.log.

In SA, the SELinux security policy module uses the Permissive mode by default. SA also supports using the SELinux security policy module in the Enforcing mode, adding an extra layer of security to the server automation process.

The transition between Permissive mode to Enforcing mode for a machine running SA with SELinux disabled or enabled is seamless without any functionality limitation.

The SELinux security policy module contains both custom file system SELinux labels as well as additional SELinux permissions.

SA SELinux policies ensure that the SA Agent and the SA Infrastructure can function when SE Linux mode is set to Enforcing.
The default SELinux policies are not intended for server hardening. To secure servers, extend the default SELinux policies.