Data is the most critical asset of any company today. There are many recommendations to secure a PostgreSQL database, e.g. CIS Benchmark for PostgreSQL, but Linux provides already one which you should not avoid: Security-Enhanced Linux (SELinux). SELinux provides access control for files, processes and applications to grant access or deny it. This security architecture was developed by the United States National Security Agency (NSA) and later in the early 2000s made open source.

This article gives a short introduction to SELinux and how you might come into contact with it while installing PostgreSQL.

The first step is to verify that SELinux is active.

Copy to Clipboard

The output displays the SELinux status which in this case displays enabled. SELinux is active.

Additionally, the SELinux mode can be verified by running getenforce.

Copy to Clipboard
The command returns the current status value which is either:
  • Enforcing: SELinux with its policies and rules is active and explicitly allows or denies access.
  • Permissive: SELinux with its policies and rules is active, but it does not enforce them, meaning nothing is denied.
  • Disabled: No rules of the SELinux policies are applied and the system is not protected.
SELinux policies are enforced and might be a obstacle for the future PostgreSQL cluster. By the way, Rockylinux has published a nice article to learn and understand SELinux.
NOTE: It is not recommended to disable SELinux, because any change, e.g. installation of a package with all its directories and files are not labeled. Enforcing SELinux policies at a later point in time guarantees some problems. A better solution is setting SELinux to permissive, because everything is still logged, but no access is denied. Evaluation of the logs will show all eventual shortcomings and is the base to solve any problems with enforced SELinux policies.
Let’s install the current major release of PostgreSQL with the command example from the official PostgreSQL website.
Copy to Clipboard

Check the status of the PostgreSQL service.

Copy to Clipboard
The PostgreSQL service is up and running and we can use the database. SELinux was no obstacle. The reason is that the installation used defaults which are known to SELinux, e.g. correct labels are applied during the installation. A quick check with the ls command displays the labels of the default PGDATA content.
Copy to Clipboard
The label postgresql_db_t is visible for all directories and files. I will stop the PostgreSQL service again.
Copy to Clipboard
A common change in most real world scenarios is the custom location of the PGDATA directory. In this example the new location of the PGDATA directory is /usd/pgsql/data.
Copy to Clipboard
Second, the systemd service file postgresql-16.service requires a change: The PGDATA environment variable needs to be set to the new directory /usd/pgsql/data. The recommended way is to create a new directory with a override.conf-file containing the changes.
Copy to Clipboard
Next, systemd is made aware of the changes by reloading the daemon.
Copy to Clipboard
Initialization of the new PostgreSQL cluster in the custom location /usd/pgsql/data is done by executing initdb again.
Copy to Clipboard
Check the SELinux labels of PGDATA and its content.
Copy to Clipboard
It’s missing the correct labels: postgresql_db_t. A manually executed step is required to set the correct labels with chcon.
Copy to Clipboard
Repeating the ls command from above displays the correct labels now.
Copy to Clipboard
The new PostgreSQL cluster is ready to run.
Copy to Clipboard
If you are running into any problems, do not forget to check the logfiles for any suspicious errors:
Copy to Clipboard
There are more options to configure SELinux for PostgreSQL, but this basic example provides a practical introduction for new users to have a quick start.

Dirk Aumüller

Dirk Aumueller arbeitet als Associate Partner für die Proventa AG. Sein technologischer Schwerpunkt liegt bei Datenbankarchitekturen mit PostgreSQL sowie Data Management Lösungen mit Pentaho. Zusätzlich zu seinen Datenbanktransformations-Projekteinsätzen ist er regelmäßig als PostgreSQL Trainer unterwegs und betreut Studenten bei ihren Abschlussarbeiten. Seine fachlichen Erfahrungen erstrecken sich über die Branchen Telco und Financial Services.