Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
SELinux is a mandatory access-control layer that confines Linux services according to a loaded policy. For a VPS, the safest rollout is to verify image support, install the distribution’s policy and audit tools, test in permissive mode, correct labels, ports and booleans, investigate AVC denials, and then return to enforcing mode permanently. Do not treat permissive mode or a blanket audit2allow module as a production fix.
What SELinux does on a VPS
Traditional Linux permissions decide whether a user or group can access a file. SELinux adds a second, mandatory layer. Its policy describes which confined processes may access labeled files, bind to labeled ports, transition into service domains, and interact with other kernel objects. A process can have sufficient Unix ownership and mode bits and still be denied by SELinux.
This matters on a VPS because one compromised service should not automatically gain every permission available to its Unix account. A web server, database, backup agent and deployment tool can each run inside a policy-defined domain. If an attacker exploits one service, SELinux can block actions outside that service’s intended access, provided the policy, labels and service transitions are correct.
SELinux is not a firewall, patching system or replacement for least-privilege Unix accounts. It is an additional control whose effectiveness depends on the policy loaded by the image, correct object labels and a deliberate operating mode.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
SELinux operating modes
| Mode | What happens | Appropriate use |
|---|---|---|
| Enforcing | The loaded policy is applied and denied operations are blocked. Red Hat describes this as the default and recommended operating mode. | Normal production operation after services have been validated. |
| Permissive | The policy is loaded and objects remain labeled, but denied operations are logged rather than blocked. Services continue past operations that would otherwise fail. | Short, controlled testing and diagnosis while collecting AVC evidence. |
| Disabled | The policy is not loaded and persistent SELinux labeling is not maintained. | Generally avoid on a host that is intended to receive SELinux protection. |
Changing the running mode with setenforce is temporary. A reboot can restore the mode configured in the system’s SELinux configuration file, so a successful test is not complete until persistence has been configured and verified.
Check whether the VPS image can run SELinux
Start with the provider’s image, kernel and filesystem rather than assuming every Linux image is equivalent. Red Hat-family and Fedora images commonly ship with SELinux policy integration, while Debian and Ubuntu setup depends on the selected image, kernel support and installed policy packages. Debian documentation specifically calls out an SELinux-capable kernel and filesystem as prerequisites.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Record the distribution name and release supplied by the VPS provider.
- Confirm that the provider image exposes a kernel and filesystems supported by SELinux.
- Check whether the image already contains policy-management, labeling and audit utilities.
- Make sure you have console or recovery access in case a service or boot sequence fails after enforcement is enabled.
- Take a provider snapshot or other tested backup before changing security policy on a remote host.
Package names and defaults differ by distribution. Install the image’s SELinux policy package, management utilities and audit tooling from its official repositories, using the distribution’s documented package manager. Do not copy a package command for another distribution merely because both systems use Linux.
Inspect the current state before changing anything
Use the following commands as a baseline:
sestatus
getenforcesestatus reports the overall status, policy type and related settings. getenforce prints the active mode directly. Save the output with your change record, along with the VPS image version and any existing audit events.
On a host already running SELinux, inspect recent AVC records before staging a change. Depending on the image, records will be in /var/log/audit/audit.log or available through the system journal. The goal is to distinguish pre-existing application problems from denials introduced during your test.
Stage the rollout in permissive mode
For a controlled test, switch the running system to permissive:
setenforce 0
getenforceThe second command should report Permissive. This state keeps policy loading and labeling active while allowing operations that the policy would deny. Red Hat documents permissive mode as useful for policy development and debugging; it should not be left in place as a security solution.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Exercise every path that matters on the VPS, not just an interactive login:
- Open a new SSH session and test the administrative commands used by your team.
- Request each web application route, including uploads, static files, background workers and health checks.
- Start, stop and reload database and queue services.
- Run scheduled backups and perform a small restore test if possible.
- Execute deployment, certificate-renewal, log-rotation and monitoring jobs.
Record the exact operation, timestamp and resulting AVC event for every failure. A denial observed only while a particular service path runs is much easier to analyze than a large, unfiltered log collected from an idle host.
Fix labels, ports and booleans before writing policy
Most first-run failures are configuration mismatches rather than evidence that the policy needs a new allow rule. Check these three areas in order.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCorrect file contexts for nonstandard paths
SELinux uses labels, not just Unix paths, to decide what a service may read or write. A web server moved from its distribution default directory to /srv/www, for example, may see files with a generic or home-directory label.
Add a persistent file-context rule with semanage fcontext, then apply it with restorecon:
semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?'
restorecon -Rv /srv/wwwThe type in this example is appropriate for content served by a web service on systems using that policy naming. Select the type documented for your service and whether the path contains writable data; do not label an entire tree as writable simply to silence an error. Verify the resulting labels and retest the operation.
Label nonstandard service ports
A daemon moved to a custom port can be denied even when its Unix configuration is correct. List the port types understood by the installed policy and add the required mapping with semanage port. For example:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
semanage port -a -t http_port_t -p tcp 8080Use the service’s documented port type and protocol. If the port is already mapped, modify the existing entry rather than creating a duplicate. Confirm that the daemon is actually listening on the intended address and port before attributing a connection failure to SELinux.
Check policy booleans
Booleans are policy switches for supported variations in service behavior. Display the available switches and their current values:
semanage boolean -lIf the policy provides a boolean for the operation you need, enable that documented switch instead of generating a local allow rule. Make the change persistent according to your distribution’s SELinux tooling and record why it is enabled; a boolean can broaden a service’s permitted behavior.
Read an AVC denial methodically
An AVC denial identifies a subject process, an object, an operation and the security contexts involved. Treat it as evidence to interpret, not as a command to approve automatically.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Reproduce one failure while the relevant service is running. Note the command, URL, file path or port and the exact time.
- Extract matching events from the audit log. On systems with audit records, begin with:
ausearch -m AVC -ts recent - Use
audit2whyto obtain an explanation of the denial and possible policy alternatives. - Compare the source and target contexts with the service’s expected domain, file labels and port labels.
- Check whether a documented boolean, service transition or path relabel resolves the operation.
- Repeat the test in enforcing mode after each narrow correction.
The SELinux troubleshooting sequence recommends reproducing the problem, collecting relevant AVCs and checking alternatives before generating policy. A denial involving an unexpected process domain can indicate that the service was started incorrectly or that an unsupported transition occurred; adding an allow rule would hide that underlying problem.
When a custom policy module is justified
If the application genuinely requires an access pattern not covered by the installed policy, create a narrowly scoped local module. First establish that the application is using the intended domain, paths have the correct labels, ports are mapped correctly and no documented boolean exists.
Generate candidate rules only from AVCs produced by the specific, repeatable workflow. Review every requested permission: identify the process, target object, operation and business reason. Remove unrelated events, test the application with the smallest rule set and document the module’s purpose and owner.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Install a reviewed module with the distribution’s semodule workflow, then restart or reload the affected service and repeat the original test. Keep the module source under configuration management so it can be audited, rebuilt and removed. Red Hat explicitly cautions that audit2allow should not be the first response to an SELinux denial; blindly piping all AVCs into it can grant substantially more access than intended.
Return the VPS to enforcing mode
After labels, ports, booleans and any reviewed module have passed testing, enable enforcement immediately:
setenforce 1
getenforcegetenforce should report Enforcing. Repeat the SSH, web, database, backup and deployment checks that you performed in permissive mode. Investigate any new denial rather than switching back permanently.
Persist the setting in the system configuration used by the image. On systems using the standard file, edit /etc/selinux/config and set:
SELINUX=enforcingSome distributions use an equivalent configuration mechanism; follow that image’s documentation. Reboot during a maintenance window, then verify the result:
sestatus
getenforceA runtime setenforce change alone does not survive reboot. The post-reboot check confirms both the configured mode and the policy actually loaded by the kernel.
Whole-system permissive mode versus a permissive domain
Whole-system permissive mode records denials without blocking them across the host. It is useful for a short migration or debugging window, but every service is effectively allowed to continue past its SELinux denials during that period.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
For a narrower experiment, Red Hat documents permissive domains. The following command makes one domain permissive while the rest of the system remains enforcing:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
semanage permissive -a <domain>Replace the placeholder with the actual service domain shown in the denial. This approach can reduce the blast radius of testing, but Red Hat warns that permissive domains can still compromise security and must be used cautiously. Remove the exception as soon as diagnosis is complete:
semanage permissive -d <domain>Common VPS failure patterns and remedies
The service cannot read a moved data directory
Check the directory’s SELinux context and compare it with a working path for the same service. Add a persistent file-context rule for only the required tree, run restorecon, and retest. Do not recursively relabel unrelated system directories.
A custom listener will not start
Confirm the daemon’s process domain and map the port to the service’s SELinux port type with semanage port. Also check for an ordinary bind conflict, firewall rule or incorrect listen address; not every startup error is an SELinux denial.
An integration needs network access
Inspect the AVC and list available booleans. If the policy documents a boolean for the integration, use that controlled switch and record its security effect. If no supported switch exists, validate the service domain and consider a narrowly reviewed module rather than enabling broad network permissions.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesAVCs appear for an unexpected executable
Stop and verify how the service was launched, which binary and unit file it uses, and whether a deployment changed the path. An unexpected domain or target label can signal a packaging or transition problem. Correct that configuration before adding permissions.
The host still reports permissive after a reboot
Check /etc/selinux/config or the distribution-equivalent file, confirm that the edit was saved with the exact SELINUX=enforcing value, and inspect sestatus for the loaded policy. A temporary setenforce 0 command, a provider image default or a boot-time configuration override may have restored permissive mode.
Distribution differences to account for
| VPS image family | What to verify | Why the workflow differs |
|---|---|---|
| Red Hat-family | Installed policy packages, management utilities, audit records and the standard SELinux configuration file. | Documentation and command defaults are centered on SELinux, but image vendors can omit or customize packages. |
| Fedora | Policy package version, utility availability, audit tooling and image-specific persistence settings. | Policy and utility versions can change with the release. |
| Debian | SELinux-capable kernel and filesystem, policy package, management utilities and audit integration. | SELinux support is an installed configuration rather than an assumption about every VPS image. |
| Ubuntu | Provider image support, kernel capability, policy package, audit tools and the documented persistence mechanism. | Image defaults and package organization differ from Red Hat-family systems. |
Use distribution-labeled documentation for package installation and persistence. The commands for inspecting state, collecting AVCs and managing labels are useful only when the corresponding utilities and policy types are installed.
Production checklist
- Confirm image, kernel and filesystem support and retain console recovery access.
- Install the image’s policy-management and audit packages from official repositories.
- Capture
sestatus,getenforceand baseline AVC information. - Stage in permissive mode only for a defined test window.
- Exercise SSH, web, database, backup, deployment and scheduled-job paths.
- Fix file contexts, port contexts and documented booleans before custom policy.
- Review every AVC and avoid automatic, unexamined
audit2allowoutput. - Use a narrow, documented module only for a verified application requirement.
- Set runtime enforcement with
setenforce 1. - Persist
SELINUX=enforcingthrough the image’s documented configuration. - Reboot in a maintenance window and verify with both
sestatusandgetenforce. - Remove temporary permissive-domain exceptions and keep policy changes in configuration management.
Bottom line
Keep a production Linux VPS in enforcing mode. Use permissive mode, or a carefully limited permissive domain, only while reproducing and understanding a problem. Correct labels, port mappings and booleans first; create a local policy module only when the application’s requirement is real, narrow and reviewed. Finally, persist the setting and verify it after reboot so the host does not silently return to a less protected state.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
