---
title: >-
  SELinux security options should be properly configured for effective
  application security
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > SELinux security options should be
  properly configured for effective application security
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# SELinux security options should be properly configured for effective application security
Classification:complianceFramework:cis-dockerControl:5.3 
## Description{% #description %}

On a host with SELinux enforcing, containers should run with an SELinux label.

## Rationale{% #rationale %}

An SELinux label confines the processes of a container to its own files, which limits what an attacker can do from inside it.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: SecurityOpt={{ .HostConfig.SecurityOpt }} ProcessLabel={{ .ProcessLabel }}'
```

Datadog applies the rule to the hosts where SELinux is enforcing. It passes the rule when a container runs with a process label other than the unconfined types `spc_t` and `unconfined_t`, and without `label=disable`, and fails it otherwise.

## Remediation{% #remediation %}

Set `selinux-enabled` in `daemon.json`:

```json
{
  "selinux-enabled": true
}
```

Then restart the daemon, and run the containers without `--security-opt label=disable`.

## Impact{% #impact %}

Bind mounts need the `:z` or `:Z` option to relabel their content.

## Default value{% #default-value %}

Docker labels the containers when the daemon enables SELinux.

## References{% #references %}

1. [https://docs.docker.com/engine/security/#other-kernel-security-features](https://docs.docker.com/engine/security/#other-kernel-security-features)
1. [https://docs.docker.com/engine/containers/run/#security-configuration](https://docs.docker.com/engine/containers/run/#security-configuration)
1. [https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_atomic_host/7/html/container_security_guide/docker_selinux_security_policy](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_atomic_host/7/html/container_security_guide/docker_selinux_security_policy)