Should I disable SELinux?

No, under 2026 security standards disabling SELinux (disabled) is not recommended. Instead, you should use it in 'Enforcing' mode by monitoring logs in 'Permissive' mode or creating correct policies. Security is a priority in Eka Sunucu VDS packages.

What is the difference between SELinux Enforcing and Permissive?

Enforcing mode actively applies security policies and blocks violations. Permissive mode only logs violations (audit.log) but does not block the process. Permissive is used for debugging.

Is Apache or Nginx 403 error caused by SELinux?

On web servers (httpd_t), you may get a 403 error if file contexts are misconfigured. You can fix this issue by correcting file labels with 'chcon' or 'restorecon' commands.

Server Hardening 2026

SELinux: The Steel Armor of Linux Security

Security-Enhanced Linux (SELinux)is an advanced security architecture integrated into the Linux kernel that provides mandatory access control (MAC). 2026 In the digital world where cyber threats have increased, it is the most effective way to protect your servers with the zero trust principle.

In this guide; You will learn in depth the working logic of SELinux, configuration methods, context management and troubleshooting techniques.

How Does It Work? Secure VDS Servers

AlmaLinux & Rocky Fully Compatible Architecture

root@ekasunucu:~# sestatus

root@server:~# sestatus

SELinux status: enabled

SELinuxfs mount: /sys/fs/selinux

SELinux root directory: /etc/selinux

Loaded policy name: targeted

Current mode: enforcing

Mode from config file: enforcing

Policy MLS status: enabled

Policy deny_unknown status: allowed

Max kernel policy version: 33

MAC Architecture

Isolate user errors with Mandatory Access Control.

Type Enforcement

Strict tagging and type checking for every file and process.

Debugging

Solve problems quickly with audit logs and audit2allow.

Service Isolation

Fully sandboxes for Apache, Nginx and MySQL.

What is SELinux and Why is it Critical in 2026?

Traditional security model in Linux operating systems DAC (Discretionary Access Control) that is, Optional Access Control. In this model, the owner of a file decides who can do what (read, write, execute) on that file. However, root A user or an elevated process can access everything in the system. This creates a major security vulnerability in modern attacks.

SELinux (Security-Enhanced Linux)To close this gap, MAC (Mandatory Access Control) that is, it uses the Mandatory Access Control model. This architecture developed by NSA, contrary to the logic of "Allow everything, block what is prohibited", "Prohibit everything, authorize only what is expressly permitted" It works on the principle.

2026 SEO and Security Note: Google and other search engines use server response times and security (HTTPS, Malware-free) as a ranking factor under "Core Web Vitals". A server hardened with SELinux protects your site's "Secure" status by preventing the spread of malware and indirectly improves your SEO performance.

Especially Shared Hosting and Reseller Hosting environments, SELinux (or derivatives such as CloudLinux CageFS) is vital to prevent one user from accessing another.

DAC vs MAC

DAC (Standard Linux): It is user focused. The file owner determines permissions. Root does everything.
MAC (SELinux): It is policy oriented. The system administrator sets the rules. Even root has to follow the rules.

Server Security Articles

SELinux Modes and State Management

SELinux can run in three different modes. It's critical to know what mode you're in when managing your server.

enforcing

It is the default and recommended mode. Security policies are actively enforced and violations are prevented. Logging is done.

permissive

Policies are not enforced, access is not blocked, but violations audit.log is saved to the file. It is used for debugging.

Disabled

SELinux is completely off. No auditing or logging is done. Not recommended. To turn it back on, the server must be restarted.

Basic Commands

To check the current status:

sestatus
# Veya sadece modu görmek for:
getenforce

Changing mode temporarily (resets after reboot):

# Permissive moda geçiş
setenforce 0

# Enforcing moda geçiş
setenforce 1

To change mode permanently /etc/selinux/config You should edit the file:

nano /etc/selinux/config
# SELINUX=enforcing lineını düzenleyin

SELinux Contexts

SELinux marks each process, file, directory and port with a "label". to this tag SELinux Context It is called. A process can only access objects whose tags are compatible.

The tag structure is as follows: user:role:type:level

User (u): SELinux user (different from Linux user). end _u It ends with .
Role (r): User's role. end _r It ends with .
Type (t): It is the most important part. Type Enforcement This is where it comes into play. end _t It ends with . (Ex: httpd_t, admin_home_t).
Level (l): MLS/MCS security level (s0, c0.c1023).

To see the tags of files -Z We use the parameter:

ls -Z /var/www/html
# Çıktı: system_u:object_r:httpd_sys_content_t:s0 index.html

Web Servers and File Tagging

Especially WordPress or when installing other CMS systems, Apache/Nginx may need permission to write to files (e.g. upload images). Even if the file permissions (chmod 755) are correct, access is denied if the SELinux tag is incorrect.

Temporary Tagging (chcon)

chcon The command changes the file label, but this change is lost when the file system is relabeled.

# Apache'nin okuyabilmesi for:
chcon -t httpd_sys_content_t /var/www/html/index.php

# Apache'nin yazabilmesi for (Upload klasörleri):
chcon -t httpd_sys_rw_content_t /var/www/html/wp-content/uploads

Permanent Tagging (semanage)

For changes to be permanent semanage fcontext is used. This adds the rule to the policy database.

# Kuralı veritabanına ekle:
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/uploads(/.*)?"

# Kuralı dosya sistemine uygula:
restorecon -Rv /var/www/html/uploads

Common Web Tags

Label Type	Description	Area of Use
`httpd_sys_content_t`	Read-only permission	Static files, .php files
`httpd_sys_rw_content_t`	Read and Write permission (Read/Write)	Cache, Upload, Log folders
`httpd_log_t`	log files	Apache/Nginx log directories

Booleans and Debugging

SELinux Booleansare switches that allow you to turn certain features on or off without recompiling the security policy. For example, you must change the boolean settings to allow Apache to connect to the database or send mail.

# Tüm booleanları listele
getsebool -a | grep httpd

# Apache'nin ağ üzerinden veritabanına bağlanmasına izin ver (WordPress for kritik)
setsebool -P httpd_can_network_connect_db 1

# Apache'nin sendmail kullanmasına izin ver
setsebool -P httpd_can_sendmail 1

* -P The parameter ensures that the change is permanent.

Troubleshooting: audit2allow

When an access is denied, this /var/log/audit/audit.log is saved to the file. To analyze these logs and create automatic permission rules audit2allow The tool is great.

# Son engellenen errorları insan okunabilir formatta gör:
ausearch -m avc -ts recent

# Errorlardan otomatik as bir izin modülü create:
grep httpd /var/log/audit/audit.log | audit2allow -M my_httpd_policy

# Oluşturulan modülü yükle:
semodule -i my_httpd_policy.pp

Custom Server Services

Standard Servers