Security-Enhanced Linux (SELinux) provides benefits in many real scenarios. Real-world examples show how SELinux stops privilege attacks, config errors, and common bugs through process isolation and user limits.

SELinux adds security in several ways:

• The default action is deny. If no SELinux policy rule allows access, SELinux blocks it. For example, if a policy does not allow a process to open a file, access is denied.
• Confined users have fewer rights. You can map Linux users to confined SELinux users to apply security rules. For example, mapping a Linux user to user_u stops that user from running sudo and su.
• SELinux domains increase process and data separation. Use domains to define which processes can access specific files and directories. For example, an attacker who compromises a Samba server cannot access files used by MariaDB databases.
• SELinux stops config errors. Attackers can exploit Domain Name System (DNS) zone transfers to inject false data. If you run Berkeley Internet Name Domain (BIND) as a DNS server on RHEL without limits on zone transfers, SELinux protects your system. The default policy stops the named daemon and other processes from using zone transfers to update zone files ¹.
• SELinux stops path traversal attacks. Attackers can exploit Apache bugs to access files using ../. SELinux in enforcing mode stops the httpd process from accessing files outside its allowed paths.
• SELinux prevents kernel NULL pointer attacks. Attackers can exploit a vulnerability in the mmap function to place code on a null page (CVE-2019-9213). SELinux in enforcing mode prevents this attack.
• SELinux prevents *PTRACE_TRACEME exploits.* You can use the deny_ptrace boolean to protect your systems from the PTRACE_TRACEME vulnerability (CVE-2019-13272). This blocks attackers from gaining root access.
• SELinux prevents NFS misconfigurations. Use the nfs_export_all_rw and nfs_export_all_ro booleans to prevent Network File System (NFS) misconfigurations. For example, SELinux can prevent accidentally sharing /home directories.