SELinux protects a system only as well as its policy does. Every service, path and process needs the right contexts and rules – and a policy bug shows up either as a needless denial or as a hole.
Scope
- SELinux policies – changing them and tracking down the bugs that make a service fail or be confined differently than intended.
- Passing the knowledge on: an internal SELinux training for colleagues (November 2022).
How SELinux works from the kernel to the policy, and how to find a bug in a policy, is covered by a separate explainer among the related items.