About rancher-selinux

To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.

Why SELinux?

By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.

The rancher-selinux RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.

Source code, policy definitions, and development guides are available in the rancher-selinux GitHub repository.

Supported Operating Systems

Table 1. Supported operating systems and repository paths
Operating System	Version	Repo path
openSUSE Leap / SLE / SLE Micro	16 / 6	`sle/16`
openSUSE MicroOS / Tumbleweed	Rolling	`microos`
RHEL / CentOS / Rocky Linux	9	`centos/9`
RHEL / CentOS / Rocky Linux	10	`centos/10`

All policies are covered by end-to-end tests. For the most up-to-date compatibility details, see the rancher-selinux support matrix.

Installing the rancher-selinux RPM

Install rancher-selinux on all SELinux-enabled nodes in the cluster. Replace <repo-path> with the corresponding path value from Supported operating systems and repository paths.

openSUSE Leap, SLE, SLE Micro, and MicroOS

cat << EOF > /etc/zypp/repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/<repo-path>/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF

zypper --gpg-auto-import-keys refresh
zypper install -y rancher-selinux

On transactional systems such as SLE Micro and openSUSE MicroOS, replace zypper install with:

transactional-update pkg install rancher-selinux
reboot

RHEL, CentOS, and Rocky Linux

cat << EOF > /etc/yum.repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/<repo-path>/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF

dnf install -y rancher-selinux

Verifying the installation

Verify that the Rancher SELinux policy modules are installed:

semodule -l | grep rancher

Configuring Applications to Work with SELinux

Installing the rancher-selinux RPM on the host does not automatically confine applications. Applications must be explicitly configured to run in an allowed SELinux container domain provided by the RPM.

To configure supported Helm charts to be SELinux aware, set global.seLinux.enabled to true in the values.yaml file when installing or upgrading the chart.

Table 2. Dedicated SELinux types by chart
Chart	Container	SELinux type
Rancher Monitoring	node-exporter	`prom_node_exporter_t`
Rancher Monitoring	pushprox	`rke_kubereader_t`
Rancher Logging	fluentbit	`rke_logreader_t`
Rancher AI	rancher-ai-agent	`rancher_aiagent_container_t`
Rancher AI	rancher-ai-mcp	`rancher_aimcp_container_t`

Only the components listed in Dedicated SELinux types by chart receive a dedicated SELinux type. Other Rancher components and general workloads use the default container_t domain provided by container-selinux.