SELinux
SELinux is a Linux security framework that enforces mandatory access-control policies on processes and resources.
Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
An SELinux system is an operating system environment with SELinux mandatory access-control enforcement enabled.
- How it is used
- Restricts container process access to host filesystems and supports mandatory access control within layered Podman isolation.
- How deep it goes
- Explains labels, policy interactions, type enforcement, and MCS, but stops short of policy authoring or troubleshooting procedures.
- Examples
- Uses container filesystem restrictions, denied access, privileged mode, and an advanced Linux security-features comparison.
- What you can do after
- Evaluate container filesystem denials as security boundaries and avoid disabling isolation with --privileged.
Kubernetes in Action, Second Edition
SELinux is a Linux security mechanism that enforces mandatory access control through labels and policy rules.
- How it is used
- Strengthens container isolation by enforcing mandatory access control over users, processes, files, and system resources.
- How deep it goes
- Defines labels and policy matching, but stops short of showing policy authoring or operational configuration.
- Examples
- Contrasts SELinux labels and policies with AppArmor file paths and process-focused protection.
- What you can do after
- Evaluate how label-based mandatory access control contributes to container and operating-system isolation.
Read how Kubernetes in Action, Second Edition explains SELinux →
Related concepts
- type enforcementhas part · Type enforcement is an SELinux access-control technique that restricts interactions according to the security types assigned to processes and resources.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.