SELinux Cheat Sheet 2026: Modes, Contexts,

A quick reference for SELinux — mandatory access control for Linux. Bookmark this page.

Status and Modes

# Check current status
getenforce                   # Enforcing, Permissive, or Disabled
sestatus                     # Detailed status

# Change mode temporarily (until reboot)
sudo setenforce 1            # Enforcing
sudo setenforce 0            # Permissive

# Change mode permanently
sudo vi /etc/selinux/config
# Set: SELINUX=enforcing

File Contexts

# View file context
ls -Z /var/www/html/
ls -Zd /var/www/html/

# Restore default context
sudo restorecon -v /var/www/html/index.html
sudo restorecon -Rv /var/www/html/       # Recursive

# Change file context temporarily
sudo chcon -t httpd_sys_content_t /var/www/html/index.html

# Set default context permanently
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
sudo restorecon -Rv /srv/web/

# List all file context rules
sudo semanage fcontext -l | grep httpd

Booleans

# List all booleans
getsebool -a
getsebool -a | grep httpd

# Check specific boolean
getsebool httpd_can_network_connect

# Set boolean temporarily
sudo setsebool httpd_can_network_connect on

# Set boolean permanently
sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_can_network_connect_db on

Port Contexts

# List port contexts
sudo semanage port -l
sudo semanage port -l | grep http

# Add custom port for a service
sudo semanage port -a -t http_port_t -p tcp 8443
sudo semanage port -a -t ssh_port_t -p tcp 2222

# Delete custom port mapping
sudo semanage port -d -t http_port_t -p tcp 8443

Troubleshooting

# View denied actions in audit log
sudo ausearch -m AVC -ts recent
sudo ausearch -m AVC -ts today

# Human-readable denials
sudo sealert -a /var/log/audit/audit.log

# Generate policy module from denials
sudo ausearch -m AVC -ts recent | audit2allow -M mypolicy
sudo semodule -i mypolicy.pp

# Watch denials in real-time
sudo tail -f /var/log/audit/audit.log | grep AVC

Process Contexts

# View process context
ps -eZ | grep httpd
ps -eZ | grep nginx

# View user context
id -Z

Policy Modules

# List installed modules
sudo semodule -l

# Install custom module
sudo semodule -i mypolicy.pp

# Remove module
sudo semodule -r mypolicy

# Generate module from denials (quick fix)
sudo grep nginx /var/log/audit/audit.log | audit2allow -M nginx_custom
sudo semodule -i nginx_custom.pp

Common SELinux Types

Tips and Tricks

• Never setenforce 0 in production — use audit2allow to fix denials properly
• Use restorecon -Rv after copying files to web directories
• Use :Z or :z volume flags with Podman/Docker for SELinux labels
• Check booleans first — most “SELinux blocking” issues are a missing boolean
• Use matchpathcon to check expected context: matchpathcon /var/www/html

Related Resources

• Linux Cheat Sheet
• RHEL 9 Administration Guide
• iptables Cheat Sheet