# SELinux

Hacker Approved page: https://hackerapproved.com/p/selinux/

21 people recommended SELinux in Hacker News comments, 15 had mixed feelings and 26 criticized it, November 2025 to October 2026. It was recommended in 10 of 12 months, in 23 threads. It does not meet the Hacker Approved badge rule.

**Verdict:** More people criticize it than recommend it. Mandatory access control for Linux that limits what processes can do, even as root. Critics find it hard to configure and often disable it.

Summary written by Claude from the comments below.

## What people warn about

- Hard to set up and maintain (5 comments in the sample): "Selinux is especially powerful for this kind of thing but also requires a lot of advanced knowledge and skills to setup and maintain sadly." ([source](https://news.ycombinator.com/item?id=48994358)) "It's a cryptic nightmare.  You run a tool that gives you some magic string and hope that it works" ([source](https://news.ycombinator.com/item?id=46252099)) "SELinux errors are still an inscrutable mess and writing SELinux policy is fairly painful." ([source](https://news.ycombinator.com/item?id=46384040))
- Often disabled when in the way (4 comments in the sample): "It’s got the SELinux problem of being useful, but annoying enough that everyone just disables it the second it gets in the way." ([source](https://news.ycombinator.com/item?id=49184897)) "when people have issues getting software to work, the first thing they are told to try is to turn all that stuff off" ([source](https://news.ycombinator.com/item?id=46096379)) "SELinux is a rather poor design, and I find that it actively gets in the way of trying to do security well." ([source](https://news.ycombinator.com/item?id=49502950))
- Not a complete defense (2 comments in the sample): "Believing SELinux solves the vast majority of security issues is fallacious" ([source](https://news.ycombinator.com/item?id=46473229)) "it appears these distros were (and are) still vulnerable to this exploit" ([source](https://news.ycombinator.com/item?id=48203253))
- Poor errors and policy tooling (1 comment in the sample): "SELinux would be a lot more viable if it had a solid way to federate and distribute policy" ([source](https://news.ycombinator.com/item?id=47717269))

## Why people recommend it

- Strong protection against exploits (7 comments in the sample): "it's a very valuable tool when you run systems that are exposed to the internet or other hostile environments" ([source](https://news.ycombinator.com/item?id=46509191)) "There is always selinux if we want to add protection against arbitrary code running as root." ([source](https://news.ycombinator.com/item?id=48061073)) "it's secure enough to use Firefox with ublock + privacy badger and enforcing SELinux" ([source](https://news.ycombinator.com/item?id=50318403))
- Robust, well-tested default (3 comments in the sample): "it’s well tested, no amount of forks and tricky indirections to bypass syscalls" ([source](https://news.ycombinator.com/item?id=46922626)) "SElinux is also quite robust in access permission handling." ([source](https://news.ycombinator.com/item?id=46896465)) "SELinux by default is a huge plus all by itself." ([source](https://news.ycombinator.com/item?id=48025254))
- Pairs well with other defenses (3 comments in the sample): "SElinux plus cgroups is probably good enough. Although as soon as it talks to the desktop environment all bets are off." ([source](https://news.ycombinator.com/item?id=49502281)) "combined with sensible SELinux policies, would likely be sufficient" ([source](https://news.ycombinator.com/item?id=48059735)) "apparmor/selinux pair incredibly well" ([source](https://news.ycombinator.com/item?id=49371283))

## What people recommend instead

- [AppArmor](https://hackerapproved.com/p/apparmor/): 10 recommend, 5 mixed, 11 criticize

## The badge

A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged.

## Cite as

Hacker Approved, "SELinux", https://hackerapproved.com/p/selinux/ (21 recommend, 15 mixed, 26 criticize; Hacker News comments, November 2025 to October 2026).

Counts updated 2 Nov 2026, with data through October 31, 2026.