---
title: "Installing the SELinux RPM package"
slug: "installing-the-selinux-rpm-package"
updated: 2026-10-26T07:24:42Z
published: 2026-10-26T07:33:50Z
canonical: "docs.trellix.com/installing-the-selinux-rpm-package"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Installing the SELinux RPM package

Download the Security-Enhanced Linux (SELinux) RPM package to your Linux system to run Trellix Agent processes in confinement mode. You can install this package on a standalone or managed Linux system after installing or upgrading to version 5.7.0 and later.

Use `sestatus` command to check whether SELinux is in enforcing, permissive, or disabled state. For information about the supported RHEL versions, see [KB51573](https://kcm.trellix.com/corporate/index?page=content&id=KB51573).

The table lists the supported SELinux policy version on the RHEL version:

| RHEL version |
| --- |
| 7.x | 7.1 to 7.9 (except version 7.0) |
| 8.x | 8.0 to 8.8 |
| 9.x | 9.0 to 9.6 |
| 10.x | 10.0 |

### Note

Trellix Agent SELinux installation fails for unsupported SELinux policy versions. Trellix Agent SELinux package supports Endpoint Security for Linux SELinux package (RPM) version 10.7.3 and later.

1. Go to [Trellix Product Downloads](https://www.trellix.com/en-us/downloads/my-products.html) and log on using your email address and a valid grant number.
2. Download the SELinux package `TrellixAgent-selinux-5.8.x-ReleasePackages.zip` to a temporary directory on your Linux system.

### Note

The RPM zip contains MFEma-selinux-5.8.x-1.src.rpm, which can be used to modify Trellix Agent SELinux policies, rules and build the customized RPM.
3. Extract the package.

` unzip TrellixAgent-selinux-5.8.x-ReleasePackages.zip -d selinux` where "selinux" is the folder name.
4. Navigate to the **selinux** folder using the following command.

` cd selinux`
5. Install SELinux RPM package on your system.

`rpm -ivh MFEma-selinux-5.8.x-<build-number>.el7.noarch.rpm`

  - Run the following command for Red Hat 7.1 to 7.8 versions:

`rpm -ivh MFEma-selinux-5.8.x-1.el7.noarch.rpm`
  - Run the following command for Red Hat 8.x versions:

`rpm -ivh MFEma-selinux-5.8.x-1.el8.noarch.rpm`
  - Run the following command for Red Hat 9.x version (Trellix Agent 5.7.9 or later):

`rpm -ivh MFEma-selinux-5.8.x-1.el9.noarch.rpm`
  - Run the following command for Red Hat 10.0 version (Trellix Agent 5.8.4 or later):

`rpm -ivh MFEma-selinux-5.8.x-1.el10.noarch.rpm`

The sample output on applying this command is:

```plaintext
# rpm -ivh MFEma-selinux-5.8.x-1.el8.noarch.rpm
Verifying... ################################# [100%]
Preparing... ################################# [100%]
MFEma-selinux is installing on - Red Hat Enterprise Linux release 8.0 (Ootpa)
Updating / installing...
1:MFEma-selinux-5.8.x-1.el8 ################################# [100%]
Installing MFEma-selinux
Successfully loaded SELinux policy (3.14.1-61) mfe_ma_rt.pp
Successfully loaded SELinux policy (3.14.1-61) mfe_ma.pp
```
6. You can use the port below 1024 in SELinux confinement mode by [configuring Trellix Agent wake-up port](/docs/configuring-trellix-agent-wake-up-port-in-selinux-confinement-mode-1).

After installing the Trellix Agent SELinux policy successfully, the Trellix Agent service restarts in confinement mode. Verify if Trellix Agent SELinux policy modules are loaded and Trellix Agent processes are running in SELinux confinement mode.

: