# SELinux SELinux is flexible Mandatory Access Control for Linux, integrated into the Linux kernel and used to enforce security policies over system objects. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Amazon Linux 2027 Enters Public Preview with SELinux Enforcing by Default DevFeed: [Amazon Linux 2027 Enters Public Preview with SELinux Enforcing by Default]() Original publisher: [Read original article]() Author: Steef-Jan Wiggers Published: 2026-09-15T03:40:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Linux](), [SELinux](), [migration](), [Amazon Web Services](), [Kernel](), [amazon]() Tags: [amazon](), [amazon-linux-2027-preview](), [architecture](), [architecture-design](), [aws](), [cloud](), [development](), [devops](), [ec2](), [infrastructure](), [kernel](), [linux](), [migration](), [news](), [operating-systems](), [preview](), [selinux](), [x86-64]() ### AI overview AWS has released Amazon Linux 2027 in public preview with SELinux enforcing by default. The change may require application and migration work because policies that only logged violations on AL2023 can block applications on AL2027. The release has no announced AL2023 end-of-support date, general-availability date, or in-place migration path. ### Source excerpt AWS has released Amazon Linux 2027 in public preview, built on the AL2023 baseline with kernel 7.1 and SELinux in enforcing mode by default. Applications that pass on AL2023's permissive mode may fail under enforcing. The announcement gives no AL2023 end-of-support date, no GA date, and no in-place migration path. By Steef-Jan Wiggers ## AAOS SDV - Secure by Design DevFeed: [AAOS SDV - Secure by Design]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-24T16:00:31Z Content type: article Language: en Sources: [Android Developers Blog]() Topics: [Android](), [Security](), [virtualization](), [virtual machines](), [SELinux](), [POSIX](), [Processes](), [Google]() Tags: [android](), [android-security](), [article](), [google](), [posix](), [process](), [security](), [selinux](), [virtual-machines](), [virtualization]() ### AI overview This article explains the security design of Android Automotive Operating System for Software Defined Vehicle (AAOS SDV). It describes virtualization for domain isolation, UID-based application and service sandboxing, POSIX capabilities, SELinux deny-by-default enforcement, and Android's vulnerability management and disclosure processes. ### Source excerpt Posted by Markus Vill, Software Engineer, Sean Keys, Security Engineer, and Istvan Nador, Software Engineer, Android Auto At Google, we believe our products should be secure by design, which is why we built the Android Automotive Operating System for Software Defined Vehicle (AAOS SDV) on existing, market-proven platforms, leveraging virtualization technologies like Cuttlefish. While our release announcements focused on the features, this blog post outlines some of the security concepts. Foundation: Domain IsolationVirtualization to isolate co-hosted instances The current trend of consolidating Electronic Control Units (ECUs) into a single chip reduces isolation by running multiple domains side-by-side. While AAOS SDV instances provide internal isolation mechanisms, it is often preferable to run logical domains independently. For instance, a cluster and an infotainment system have distinct requirements. We use virtual machines to run multiple instances in parallel, ensuring that sharing remains explicit and isolation is the default behavior. Inherited Android Security AAOS SDV evolved from Microdroid, a minimalistic Android version optimized for privacy virtual machines (pVM). This lineage provides Android platform engineers with established security features they already know. Process Isolation & Deny by Default AAOS SDV follows Android's User ID (UID)-based isolation model to set up a sandbox for each application. Each service runs in a dedicated process with a unique UID to manage access rights, data directories, and other restrictions. We employ Portable Operating System Interface (POSIX) capabilities to strictly limit operations and pair this with Security-Enhanced Linux (SELinux) to enforce a "deny-by-default" posture. This approach restricts each service to the absolute minimum required, meaning missing configurations block access rather than creating an over-permissive system. We apply this same strategy to our communication permission system, as explained l ## AAOS SDV - Secure by Design DevFeed: [AAOS SDV - Secure by Design]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-24T16:00:31Z Content type: article Language: en Sources: [Android Developers Blog](), [Android Developers Blog]() Topics: [Android](), [Security](), [SELinux](), [virtualization](), [vulnerability management](), [Process](), [Resilience](), [Google]() Tags: [android](), [android-security](), [article](), [automotive](), [blog](), [deep-dive](), [google](), [process](), [resilience](), [security](), [selinux](), [virtualization](), [vulnerabilities](), [vulnerability-management]() ### AI overview AAOS SDV is presented as a secure-by-design platform for software-defined vehicles. The article explains how virtualization isolates co-hosted domains, while Android UID-based process sandboxes, POSIX capabilities, and SELinux enforce least privilege and deny-by-default access. It also describes vulnerability response, penetration testing, security audits, and architectural reviews. ### Source excerpt Posted by Markus Vill, Software Engineer, Sean Keys, Security Engineer, and Istvan Nador, Software Engineer, Android Auto At Google, we believe our products should be secure by design, which is why we built the Android Automotive Operating System for Software Defined Vehicle (AAOS SDV) on existing, market-proven platforms, leveraging virtualization technologies like Cuttlefish. While our release announcements focused on the features, this blog post outlines some of the security concepts. Foundation: Domain IsolationVirtualization to isolate co-hosted instances The current trend of consolidating Electronic Control Units (ECUs) into a single chip reduces isolation by running multiple domains side-by-side. While AAOS SDV instances provide internal isolation mechanisms, it is often preferable to run logical domains independently. For instance, a cluster and an infotainment system have distinct requirements. We use virtual machines to run multiple instances in parallel, ensuring that sharing remains explicit and isolation is the default behavior. Inherited Android Security AAOS SDV evolved from Microdroid, a minimalistic Android version optimized for privacy virtual machines (pVM). This lineage provides Android platform engineers with established security features they already know. Process Isolation & Deny by Default AAOS SDV follows Android's User ID (UID)-based isolation model to set up a sandbox for each application. Each service runs in a dedicated process with a unique UID to manage access rights, data directories, and other restrictions. We employ Portable Operating System Interface (POSIX) capabilities to strictly limit operations and pair this with Security-Enhanced Linux (SELinux) to enforce a "deny-by-default" posture. This approach restricts each service to the absolute minimum required, meaning missing configurations block access rather than creating an over-permissive system. We apply this same strategy to our communication permission system, as explained l ## SELinux Volume Label Changes goes GA (and likely implications in v1.37) DevFeed: [SELinux Volume Label Changes goes GA (and likely implications in v1.37)]() Original publisher: [Read original article]() Author: Jan Šafránek Swathi Rao Published: 2026-04-22T18:35:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [SELinux](), [Kubernetes](), [Linux](), [Security](), [mount]() Tags: [kubernetes](), [linux](), [mount](), [security](), [selinux]() ### AI overview Kubernetes' SELinuxMount feature is expected to become enabled by default in a future release, anticipated to be v1.37. The change can speed up volume setup by avoiding recursive relabeling, but may affect applications that rely on the previous behavior. Kubernetes v1.36 is presented as the release to audit clusters and address compatibility concerns. ### Source excerpt If you run Kubernetes on Linux with SELinux in enforcing mode, plan ahead: a future release (anticipated to be v1.37) is expected to turn the SELinuxMount feature gate on by default. This makes volume setup faster for most workloads, but it can break applications that still depend on the older recursive relabeling model in subtle ways (for example, sharing one volume between privileged and unprivileged Pods on the same node). Kubernetes v1.36 is the right release to audit your cluster and fix or opt out of this change. If your nodes do not use SELinux, nothing changes for you: the kubelet skips the whole SELinux logic when SELinux is unavailable or disabled in the Linux kernel. You can skip this article completely. This blog builds on the earlier work described in the Kubernetes 1.27: Efficient SELinux Relabeling (Beta) post, where the SELinuxMountReadWriteOncePod feature gate was described. The problem to be addressed remains the same, however, this blog extends that same approach to all volumes. The problem Linux systems with Security Enhanced Linux (SELinux) enabled use labels attached to objects (for example, files and network sockets) to make access control decisions. Historically, the container runtime applies SELinux labels to a Pod and all its volumes. Kubernetes only passes the SELinux label from a Pod's securityContext fields to the container runtime. The container runtime then recursively changes the SELinux label on all files that are visible to the Pod's containers. This can be time-consuming if there are many files on the volume, especially when the volume is on a remote filesystem. Caution:If a container uses subPath of a volume, only that subPath of the whole volume is relabeled. This allows two Pods that have two different SELinux labels to use the same volume, as long as they use different subpaths of it. If a Pod does not have any SELinux label assigned in the Kubernetes API, the container runtime assigns a unique random label, so a process that p ## GPU Driver Attacks on Android and Their Mitigation in KasperskyOS DevFeed: [GPU Driver Attacks on Android and Their Mitigation in KasperskyOS]() Original publisher: [Read original article]() Author: denis\_molodyakov ("Лаборатория Касперского") Published: 2026-02-25T15:14:03Z Content type: tutorial Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [GPU](), [Security](), [SELinux](), [Arm](), [LineageOS]() Tags: [android](), [arm](), [dma](), [gpu](), [iommu](), [kasperskyos](), [security](), [selinux](), [tag-33729a63fe14](), [tag-a6bf72199ce9](), [tag-c87ceb311a81](), [tag-cc2a6346d835]() ### AI overview This article explains attacks against GPU drivers, focusing on Android devices with integrated ARM Mali accelerators. It describes memory-management and use-after-free attack cases, including one that could enable full device access and disable SELinux, and discusses how similar scenarios are mitigated in the microkernel-based KasperskyOS. ### Source excerpt Что вы знаете об атаках на графические процессоры? Наверняка ничего приятного: они крайне распространены на мобильных устройствах, классические "песочницы" от них не защищают, и компрометация лишь одного драйвера может поставить под угрозу все ядро... Меня зовут Денис Молодяков, и я -- лид команды графики в KasperskyOS. Идея этого текста возникла во время одного моего выступления на конференции по системной разработке. Тогда из зала задали вопрос, который касался безопасности работы драйверов GPU. Слушатель ссылался на кейсы с "подламыванием" механизма управления видеопамятью драйверов на Android для интегрированных ускорителей семейства ARM Mali и спросил, как наша ОС сможет этому противостоять. Поэтому в данном материале я подробно расскажу о сути этой коварной атаки, а также рассмотрю и другие типы атак через GPU. В заключение я смоделирую подобные сценарии для нашей микроядерной KasperskyOS и покажу, как мы их митигируем. Читать далее ## Proxy inverso con Nginx: guía práctica DevFeed: [Proxy inverso con Nginx: guía práctica]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-09T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [nginx](), [proxy](), [rate-limiting](), [let's encrypt](), [rhel](), [SELinux]() Tags: [let-s-encrypt](), [nginx](), [proxy](), [rate-limiting](), [rhel](), [selinux](), [ssl]() ### AI overview A practical Spanish-language guide to using Nginx as a reverse proxy. It covers routing traffic to internal applications, HTTPS with Let's Encrypt, load balancing, upload and proxy timeout settings, request-rate limiting, gzip compression, security headers, and the 502 issue associated with SELinux on RHEL. ### Source excerpt Nginx como proxy inverso: subidas de archivos grandes, timeouts, rate limiting, gzip y el clásico 502 por SELinux en RHEL. ## Further Hardening Android GPUs DevFeed: [Further Hardening Android GPUs]() Original publisher: [Read original article]() Author: Edward Fernandez (noreply@blogger.com) Published: 2025-12-09T17:00:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [GPU](), [Security](), [Android](), [Arm](), [SELinux](), [Kernel](), [Vulnerabilities]() Tags: [android](), [android-security](), [arm](), [gpu](), [kernel](), [none](), [security](), [selinux](), [vulnerabilities]() ### AI overview Google's Android Red Team and Arm analyzed the Mali GPU driver and firmware stack to reduce the driver's attack surface. The post describes using SELinux to restrict GPU IOCTLs that are intended for development, debugging, instrumentation, or deprecated use in production. ### Source excerpt Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team Last year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the GPU software and firmware stack. While finding and fixing individual bugs is crucial, and progress continues on eliminating them entirely, making them unreachable by restricting attack surface is another effective and often faster way to improve security. This post details our efforts in partnership with Arm to further harden the GPU by reducing the driver's attack surface. The Growing Threat: Why GPU Security Matters The Graphics Processing Unit (GPU) has become a critical and attractive target for attackers due to its complexity and privileged access to the system. The scale of this threat is significant: since 2021, the majority of Android kernel driver-based exploits have targeted the GPU. These exploits primarily target the interface between the User-Mode Driver (UMD) and the highly privileged Kernel-Mode Driver (KMD), where flaws can be exploited by malicious input to trigger memory corruption. Partnership with Arm Our goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats. We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices. This collaboration was crucial for understanding the driver's attack surface and identifying areas that posed a security risk, but were not necessary for production use. The Right Tool for the Job: Hardening with SELinux One of the key findings of our investigation was the opportunity to restrict access to certain GPU IOCTLs. IOCTLs act as the GPU kernel driver's user input and output, as well as the attack surface. This approach builds on earlier k ## What Is SELinux? DevFeed: [What Is SELinux?]() Original publisher: [Read original article]() Author: Zachary Bouhannana Published: 2025-06-09T04:53:08Z Content type: tutorial Language: en Sources: [Baeldung - Linux]() Topics: [SELinux](), [Linux](), [Security](), [Processes](), [Operating system]() Tags: [access-control](), [administration](), [administration-security-chmod-ls-selinux](), [chmod](), [linux](), [ls](), [processes](), [security](), [selinux](), [tutorial]() ### AI overview This tutorial explains SELinux, a security module built into the Linux kernel that adds mandatory access control beyond traditional Unix-style permissions. It describes how SELinux policies govern interactions between processes, users, and system resources, including limiting actions by root, and contrasts this model with discretionary access control. ### Source excerpt Learn what SELinux is, how it works, and the way it can provide better security when paired with the common discretionary access control. The post What Is SELinux? first appeared on Baeldung on Linux. Related Stories Sending a Password via SSH or SCP Using subprocess.Popen in Linux Resolving the Reverse Tunnel Remote port forwarding failed for listen port SSH Error How to Fix USB Sticks Mounted as Read-Only ## What is SELinux? DevFeed: [What is SELinux?]() Original publisher: [Read original article]() Author: jakub.nyckowski@goteleport.com (Jakub Nyckowski) Published: 2022-12-13T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SELinux](), [Access Control](), [Linux](), [Security](), [Linux Kernel](), [Framework]() Tags: [access-control](), [blog-post](), [deep-dive](), [framework](), [linux](), [linux-kernel](), [security](), [selinux]() ### AI overview This tutorial explains SELinux, its history, and how it provides Mandatory Access Control on Linux alongside traditional Discretionary Access Controls. It introduces Linux Security Modules and discusses related modules such as AppArmor, SMACK, and BPF. ### Source excerpt In this blog post, we'll deep-dive into SELinux. ## SELinux Support for Kubernetes in Gravity 7.0 DevFeed: [SELinux Support for Kubernetes in Gravity 7.0]() Original publisher: [Read original article]() Author: info@goteleport.com (Dmitri Shelenin) Published: 2020-05-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SELinux](), [Kubernetes](), [Security]() Tags: [cncf](), [how-to](), [kubernetes](), [security](), [selinux]() ### AI overview This article explains how the Gravity team added SELinux support to Gravity 7.0, a Kubernetes distribution. It covers the resulting base cluster policy, policy attributes and interfaces, file labels and equivalence rules, and the confinement of Kubernetes services and user workloads. ### Source excerpt Learn how we built SELinux support for Gravity 7.0, issues we had, and useful tips. Also learn how we are confining Kubernetes services and workloads. ## Announcing Gravity 7.0 DevFeed: [Announcing Gravity 7.0]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2020-03-04T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Kubernetes clusters](), [Kubernetes](), [Security](), [SELinux](), [Cloud](), [Open Source]() Tags: [cloud](), [kubernetes](), [kubernetes-clusters](), [on-prem](), [open-source](), [release](), [security](), [selinux]() ### AI overview Teleport announces Gravity 7.0, a release that lets users deploy Gravity cluster images into existing Kubernetes clusters such as OpenShift or GKE. It also adds security and compliance enhancements, including SELinux support, for deployments across cloud, on-premises, edge, and other infrastructure environments. ### Source excerpt Gravity 7.0 allows users to deploy Gravity cluster images into Kubernetes clusters and makes it easier to run Gravity clusters in secure environments. ## Containers, Security, and Echo Chambers DevFeed: [Containers, Security, and Echo Chambers]() Original publisher: [Read original article]() Published: 2018-05-20T19:17:58Z Content type: opinion Language: en Sources: [Jessie Frazelle]() Topics: [Containers](), [Security](), [Docker](), [Kubernetes](), [SELinux](), [Linux Kernel](), [vulnerability]() Tags: [containers](), [docker](), [kubernetes](), [linux-kernel](), [security](), [selinux](), [vulnerability]() ### AI overview An opinion article argues that container security should rely on layered isolation and secure defaults, discussing Docker's Seccomp and AppArmor profiles, Linux kernel isolation, and efforts to bring these protections to Kubernetes. It responds to messaging around gVisor and sandboxing. ### Source excerpt There seems to be some confusion around sandboxing containers as of late, mostly because of the recent launch of gvisor. Before I get into the body of this post I would like to make one thing clear. I have no problem with gvisor itself. I think it is very technically "cool." I do have a problem with the messaging around it and marketing. There is a large amount of ignorance towards the existing defaults to make containers secure. Which is crazy since I have written many blog posts on it and given many talks on the subject. But I digress, let's focus on the part of the README that mentions sandboxing with SELinux, Seccomp, and Apparmor. It says: "However, in practice it can be extremely difficult (if not impossible) to reliably define a policy for arbitrary, previously unknown applications, making this approach challenging to apply universally." Greetings. Reporting for duty. Literally I am the person who can do that. I was the person who did do that. I added the default Seccomp profile to Docker and maintained the default Apparmor profile. I have also done A LOT of research with regard to Linux kernel isolation and making containers secure. I also literally reported for duty, two years ago and made the patch to add the Seccomp annotation to Kubernetes... with the hopes of eventually turning on a default filter. @nathanmccauley @brendandburns @kelseyhightower @thockin I already offered to help -- jessie frazelle (@jessfraz) April 5, 2016 All big organizations have problems with "not invented here." I tried my very best to inform everyone how these sandboxing mechanisms work but I am going to try one last time here. More than One Layer of Security Required In my last blog post, Hard Multi-Tenancy in Kubernetes, I mentioned this as well. It is also a good read if you want to learn about the thought process for secure isolation. To be truly secure you need more than one layer of security so that when there is a vulnerability in one layer, the attacker also needs a vulnerab