|Index|Using SELinux with SAP Workloads
SUSE Linux Enterprise Server 16.0

Using SELinux with SAP Workloads

Publication Date: 30 Jul 2026

SUSE Linux Enterprise Server 16.0 automatically configures SELinux to support SAP workloads out of the box. The default configuration ensures a seamless deployment process and allows administrators to safely validate security policies.

1 How does SLES handle SELinux for SAP workloads?

 

By default, SUSE Linux Enterprise Server 16.0 enhances security by enabling SELinux in enforcing mode. When SAP patterns are installed, the operating system automatically adjusts its security policies:

  • The SELinux mode changes from enforcing to permissive. In the permissive mode, SELinux is active and access denial entries are logged, but no access is denied. This configuration allows administrators to review their local setup and adjust SELinux policies before switching to enforcing mode.

  • SAP software runs in an unconfined domain. Unconfined domain means that there are no restrictions on the SAP software. It can access system resources without SELinux control.

This configuration ensures that the operating system is fully prepared for SAP software installations.

For more information about SELinux, see Understanding SELinux Basics.

2 SELinux support with SAP software

 

By default, after installing any SAP pattern, SUSE Linux Enterprise Server is automatically configured with SELinux enabled in permissive mode and SAP software in the unconfined domain. No further action is required before the installation.

Validation states differ depending on the SAP workload:

  • SAP HANA is validated on SLES 16.0 in both permissive and enforcing modes. For more information, see SAP Note 3577842.

  • Other SAP software is validated on SLES 16.0 in permissive mode only. For more information, see SAP Note 3565382.

3 Relabeling the system after SAP software installations

 

After installing SAP software, relabel the freshly installed files so they receive the correct security contexts.

To relabel the system, choose one of the following methods:

  • Use the restorecon command: 

    > sudo restorecon -Rv /

    Then restart all SAP services.

  • Create the .autorelabel file in the root (/) partition and reboot the system. The system will automatically relabel all files during the next reboot: 

    > sudo touch /.autorelabel
> sudo reboot

4 Resolving SELinux access violations

 

When SELinux denies permission to access an object, it creates an audit log using Access Vector Cache (AVC) denials.

Because SUSE Linux Enterprise Server defaults to permissive mode after installing SAP patterns, administrators can identify and resolve potential security issues without disrupting the system. If you are running SAP HANA, resolving these violations is a required step before you transition the system to enforcing mode.

Search for the AVC denials with the ausearch utility by running the following command: 

> sudo ausearch -m AVC -ts boot
type=AVC msg=audit(1784184190.493:34): avc:  denied  { name_connect } for
pid=857 comm="erts_sched_1" dest=5432 scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket permissive=1

For more information on how to address the AVC denials, see SELinux troubleshooting.

5 Switching to enforcing mode

 

An administrator can switch to enforcing mode after the SAP HANA setup is tested and no access violations occur.

Important
Important: Enforcing mode for SAP HANA only

Switching to enforcing mode is currently supported for SAP HANA workloads only. Other SAP software must remain in permissive mode.

To change to SELinux enforcing mode, follow the steps described in Changing the SELinux mode.

6 Troubleshooting the SAP SELinux configuration

 

If you encounter issues with running SAP software under SELinux, first verify that the selinux-policy-sapenablement package is installed. This package is automatically installed as part of any SAP pattern. 

> rpm -q selinux-policy-sapenablement
selinux-policy-sapenablement-1-160000.2.3.noarch

For additional troubleshooting, see SELinux troubleshooting.