SELinux Update
summary
Kernel and userland SELinux updates focus on concrete features and numbers: new LSM syscalls to list/get/set LSM attributes, deprecating the niche selinuxfs user file with a 5‑second pause in 6.17, and a new IO_uring allowed permission plus a watch_mount ns permission. Policy and tooling gain finer controls for firmware/kernel/initramfs/policy/cert loads, three new tools (get_policy_load, selabel_compare, unsetfiles), Wayland sandbox support, container/Kubernetes policy work, a never_audit per-domain flag (can skip SELinux processing when combined with permissive), and a ~40% pathwalk win from per-task directory caching.
AI-written summary · about
chapters (15)
- 0:00SELinux overview
- 1:06SELinux adoption stories
- 2:27New kernel APIs
- 3:32Deprecating user file
- 4:37Access control improvements
- 6:02Performance enhancements
- 7:08Upcoming features
- 8:34Boot and policy loading
- 11:46Container improvements
- 12:48User space tools
- 14:12Policy language updates
- 15:15Systemd enhancements
- 15:56SELinux documentation
- 17:20Contributors
- 18:22Resources
related talks
11mSubsystem Update: State of SELinux, 2019
09mSub-system Update: State of SELinux
15mSELinux
31mOverview and Recent Developments: SELinux
46m20 years of NSA Security Enhanced Linux, a Retrospective
45mSELinux All the Way Down: Namespaces for SELinux
49mSELinux introduction
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next