SELinux on RLC Pro AI

RLC Pro AI ships with SELinux enforcing by default, using the standard targeted policy. The pre-installed AI stack is built and validated to run under enforcing mode: there is no need to set permissive mode or disable SELinux to train or serve models.

Checking SELinux status

getenforce

Enforcing

For the full picture:

sudo sestatus

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing

SELinux and containers

Container workloads are where SELinux most often surprises AI users, typically as Permission denied errors when a container touches a host directory. The fix is labeling the volume, not disabling SELinux: append :Z (private label) or :z (shared label) to the mount.

mkdir ~/dataset
podman run --rm -v ~/dataset:/data:Z \
  depot.ciq.com/rlc-ai-9/rlc-9-ai-oci-images/rlc-pro-ai:9 ls /data

The :Z suffix relabels the host path so the container's SELinux context can access it. Use :z instead when several containers must share the same host directory.

Investigating denials

When something is blocked, the denial is logged in the audit log. Query recent AVC denials with:

sudo ausearch -m AVC -ts recent

No matches means SELinux is not what is blocking you. If there are matches, the message names the process, target, and permission involved, which usually points directly at a missing label or boolean.

What not to do

Setting SELINUX=disabled or booting permissive to "fix" an AI workload trades away the mandatory access control that production systems need, and on RLC Pro AI it buys you nothing: the shipped stack runs enforcing. If you hit a denial you cannot resolve with labeling, capture the ausearch output and contact CIQ Support.