Installing the SELinux RPM package

Download the Security-Enhanced Linux (SELinux) RPM package to your Linux system to run Trellix Agent processes in confinement mode. You can install this package on a standalone or managed Linux system after installing or upgrading to version 5.7.0 and later.

Use sestatus command to check whether SELinux is in enforcing, permissive, or disabled state. For information about the supported RHEL versions, see KB51573.

The table lists the supported SELinux policy version on the RHEL version:

RHEL version
7.x	7.1 to 7.9 (except version 7.0)
8.x	8.0 to 8.8
9.x	9.0 to 9.6
10.x	10.0

Note

Trellix Agent SELinux installation fails for unsupported SELinux policy versions. Trellix Agent SELinux package supports Endpoint Security for Linux SELinux package (RPM) version 10.7.3 and later.

Go to Trellix Product Downloads and log on using your email address and a valid grant number.
Download the SELinux package TrellixAgent-selinux-5.8.x-ReleasePackages.zip to a temporary directory on your Linux system.
Note
The RPM zip contains MFEma-selinux-5.8.x-1.src.rpm, which can be used to modify Trellix Agent SELinux policies, rules and build the customized RPM.
Extract the package.
unzip TrellixAgent-selinux-5.8.x-ReleasePackages.zip -d selinux where "selinux" is the folder name.
Navigate to the selinux folder using the following command.
cd selinux
Install SELinux RPM package on your system.
rpm -ivh MFEma-selinux-5.8.x-<build-number>.el7.noarch.rpm
- Run the following command for Red Hat 7.1 to 7.8 versions:
  rpm -ivh MFEma-selinux-5.8.x-1.el7.noarch.rpm
- Run the following command for Red Hat 8.x versions:
  rpm -ivh MFEma-selinux-5.8.x-1.el8.noarch.rpm
- Run the following command for Red Hat 9.x version (Trellix Agent 5.7.9 or later):
  rpm -ivh MFEma-selinux-5.8.x-1.el9.noarch.rpm
- Run the following command for Red Hat 10.0 version (Trellix Agent 5.8.4 or later):
  rpm -ivh MFEma-selinux-5.8.x-1.el10.noarch.rpm
The sample output on applying this command is:
```
# rpm -ivh MFEma-selinux-5.8.x-1.el8.noarch.rpm
Verifying... ################################# [100%]
Preparing... ################################# [100%]
MFEma-selinux is installing on - Red Hat Enterprise Linux release 8.0 (Ootpa)
Updating / installing...
1:MFEma-selinux-5.8.x-1.el8 ################################# [100%]
Installing MFEma-selinux
Successfully loaded SELinux policy (3.14.1-61) mfe_ma_rt.pp
Successfully loaded SELinux policy (3.14.1-61) mfe_ma.pp
```
You can use the port below 1024 in SELinux confinement mode by configuring Trellix Agent wake-up port.

After installing the Trellix Agent SELinux policy successfully, the Trellix Agent service restarts in confinement mode. Verify if Trellix Agent SELinux policy modules are loaded and Trellix Agent processes are running in SELinux confinement mode.