SELinux is a mandatory access control system (default on RHEL, CentOS, Fedora) that labels every process and object and enforces a policy on their interactions. Its mode — enforcing, permissive or disabled — significantly changes what an attacker can do after a foothold.
What is SELinux?#
SELinux assigns security contexts (labels) to processes and files and allows interactions only where the policy permits. Enforcing blocks violations; permissive only logs them; disabled turns it off entirely.
Why LinPEAS checks selinux#
LinPEAS reports the SELinux status among system protections because an enforcing policy can neutralise techniques that would otherwise work, while permissive/disabled removes that barrier.
What a normal configuration looks like#
On RHEL-family systems SELinux is enforcing with the targeted policy, confining major services.
Why it can be security-sensitive#
Permissive or disabled SELinux removes a strong containment layer. Custom or loosened policies (over-broad booleans, permissive domains) can also widen the surface.
Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.
How to check it manually#
Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:
getenforce; sestatus 2>/dev/nullcat /etc/selinux/config 2>/dev/nullDefensive remediation#
- Keep SELinux enforcing where the platform supports it.
- Avoid setting domains permissive or disabling it to “make things work.”
- Review custom booleans and policy modules.
Sources & references
- HackTricks: Linux privilege escalation
- GTFOBins — abuse techniques for standard binaries
- PEASS-ng repository — reviewed 20260908-dffb9496