> ## Documentation Index
> Fetch the complete documentation index at: https://qualcomm-3.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Enable SELinux
SELinux is enabled by default in the qcom-distro-catchall distribution and runs in Enforcing mode.
When SELinux is enabled, all system objects, including files, directories, processes, sockets, drivers, and more, are labeled with a security context.
A security context consists of a user, role, type identifier, and optional sensitivity, separated by colons.
For example: `user:role:type:sensitivity`
**Note**
*User* is unrelated to a Linux user, and *Type* is unrelated to the kind of object it is.
* A set of valid users, roles, and types is defined in the policy.
* Different objects are labeled with the same security context.
* The MAC mechanism of SELinux security policies is implemented using:
* Type enforcement (TE)
* Role-based access control (RBAC)
* Refpolicy Targeted
* Types enable the policy to specify the allowed operations.
**Figure : SELinux process**
The following procedures explains how to verify and enable SELinux and modify SELinux modes.
**Note**
By default, **SELinux is enabled** and configured in Enforcing mode to provide mandatory access control and strengthen platform security. During development and debugging, SELinux can be temporarily switched to Permissive mode to log policy violations without enforcing access restrictions. For production and commercial deployments, Qualcomm recommends keeping SELinux in Enforcing mode
## **Verify and modify SELinux mode**
If SELinux is enabled, you may not be allowed to update the anti-rollback protection flag.
1. Check the current SELinux configuration of the device (Enforcing or Permissive mode):
```text theme={null}
getenforce
```
2. If it’s set to the Enforcing mode, run the `setenforce` command to change the mode.
1. Connect to the device using SSH.
2. Change the SELinux mode by using the following commands.
* To switch the device to Enforcing mode:
```text theme={null}
setenforce 1
```
* To switch the device to Permissive mode:
```text theme={null}
setenforce 0
```
* To recheck the current configuration of the device (Enforcing or Permissive mode):
```text theme={null}
getenforce
```
## **SSH Enablement on SELinux build**
By default, ssh login is restricted in selinux enforcing mode.
SSH login enablement is allowed only for developent & debugging purpose.
Ways To enable SSH login:
1. Build time enablement:
* Create a patch on top of existing refpolicy with `gen_tunable(ssh_sysadm_login, true)` in [refpolicy/policy/modules/services/ssh.te](https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/services/ssh.te#L20)
* See [Customize Security Services](./customize-security-services.mdx) to add patch to existing workspace.
* Build selinux distro & Flash on the device.
* Login to SSH
2. Runtime Enablement
* Login to serial console
* Run the following command:
```text theme={null}
setsebool -P ssh_sysadm_login true
```
* Login to SSH
## **Configure SELinux (Enable, disable, and switch modes)**
To switch to Enforcing mode (restrictive) or Permissive mode (non-restrictive with logging), follow these steps:
1. To enable or disable SELinux:
* To disable SELinux for the build, set `DEFAULT_ENFORCING` to `disabled` in the SELinux distro configuration file:
```text theme={null}
meta-qcom-distro/conf/distro/include/qcom-distro-selinux.inc
DEFAULT_ENFORCING ?= "disabled"
```
* To enable SELinux, set `DEFAULT_ENFORCING` to `enforcing` (set by default).
* Use policy version 35.
* To add policies for SELinux, see upstream [refpolicy](https://github.com/SELinuxProject/refpolicy).
2. Check the system status with `getenforce` on target. This command returns one of the three values:
* Enforcing
* Permissive
* Disabled
3. To change the mode, select a mode at runtime by running `setenforce` with a number (this change won’t persist after reboot).
| **Command** | **Result** |
| :------------: | :-----------------------: |
| `setenforce 1` | Switch to Enforcing mode |
| `setenforce 0` | Switch to Permissive mode |
1. To persist after reboot:
1. Connect to the device using SSH. For instructions, see [Qualcomm Linux Build Guide](https://docs.qualcomm.com/bundle/publicresource/topics/80-80021-254/how_to.html#use-ssh).
2. Edit SELINUX= to one of the three supported values: `enforcing`, `permissive`, or `disabled` in `/etc/selinux/config`.
3. Reboot the device using the following command:
> ```text theme={null}
> reboot
> ```
2. To specify the SELinux mode in the build: Change the `DEFAULT_ENFORCING` build flag to one of the three supported values: enforcing, permissive, or disabled.
```text theme={null}
meta-qcom-distro/conf/distro/include/qcom-distro-selinux.inc
-- DEFAULT_ENFORCING = "permissive"
++ DEFAULT_ENFORCING = "enforcing"
```
4. The SELinux Disabled mode leaves behind many code paths that go through the SELinux framework. These code paths aren’t useful for KPI testing or verifying bugs in the SELinux framework. It also doesn’t allow any more access than Permissive mode.
To disable the feature for testing, remove SELinux from `DISTRO_FEATURES`:
```text theme={null}
meta-qcom-distro/conf/distro/include/qcom-distro-selinux.inc
-- DISTRO_FEATURES:append = " selinux"
```
## **Next steps**
* To ensure that only the verified and trusted applications are loaded during the startup process, see [Enable UEFI secure boot](./enable-uefi-secure-boot).
* For chipset feature management and to upgrade the chipset feature packs, see [Install or upgrade SoftSKU feature packs](./install-or-upgrade-the-soft-sku-feature-packs).