Targeted vs. MLS SELinux Policies: Management Simplicity or High-Assurance Security

SELinux Policy Selection for Fedora Server

Fedora 39 utilizes the Targeted SELinux policy by default, which focuses on confining specific high-risk network services while leaving most user processes unconfined. This approach minimizes administrative overhead and ensures compatibility with most standard packages.

For environments requiring strict data classification and role-based access controls, the Multi-Level Security (MLS) policy provides a more granular security model. However, MLS requires extensive custom policy authoring and may result in application failures if the default policies do not align with specific software requirements.

When designing a high-security server deployment, there is an unresolved trade-off between the stability of the Targeted policy and the rigorous isolation provided by MLS.

• Does the increased security posture of MLS justify the risk of application instability in a production Fedora environment?
• What is the recommended strategy for verifying MLS compatibility across a diverse set of third-party packages before full deployment?