Secure your containers using SELinux

SELinux lets you strengthen container isolation and access control on your host machines. When you enable SELinux on host machines running Red Hat Enterprise Linux (RHEL), SELinux is also enabled for the container runtime. You must enable SELinux across all host machines in your cluster, which you can configure before or after cluster creation or upgrades.

Check if SELinux is enabled

SELinux is enabled on RHEL by default.

  • To verify, run:

    getenforce

The command returns either Enforcing, Permissive, or Disabled. If the command returns Enforcing, then you can proceed with upgrading or creating your clusters.

Enable SELinux

If the getenforce command returns Permissive, you can switch to Enforcing mode using the setenforce command. Toggling between Permissive and Enforcing mode using setenforce doesn't require a system reboot. However, if you want the changes to be persistent across reboots, you must update the /etc/selinux/config file.

  • To switch to Enforcing mode, run:

    sudo setenforce 1 # temporary
sudo sed -i 's/SELINUX=permissive/SELINUX=enforcing/g' /etc/selinux/config # persistent - after reboot

If SELinux is Disabled, to enable it, we recommend to first enable it in Permissive mode first and reboot the system to verify that the system boots successfully. If there are no SELinux errors, then you can safely switch SELinux to Enforcing mode.

  1. Optional: Enable SELinux in Permissive mode:

      sudo sed -i 's/SELINUX=disabled/SELINUX=permissive/g' /etc/selinux/config
  sudo reboot

  2. If the system reboots successfully with no SELinux errors, then you can enable Enforcing mode:

      sudo sed -i 's/SELINUX=disabled/SELINUX=enforcing/g' /etc/selinux/config
  sudo reboot

Once SELinux is enabled in Enforcing mode, SELinux is enabled for all processes on the host, including the container runtime.