selinux-agent-confinement

SELinux confinement restricts AI coding agents by generating policy modules that define process domains and workspace file labels, ensuring agents only access explicitly labeled project directories while protecting personal data like SSH keys.

You can create SELinux policies for AI agents on Fedora and RHEL by generating .te, .fc, and .if policy modules that define executable entrypoints and manage file context strategies for secure agent operation.

The best way to confine tools like opencode or aider is creating SELinux policy modules that label specific project directories, restricting the agent process domain to only interact with workspace files while blocking broader home directory access.

SELinux agent confinement addresses relabel-on-update issues by managing file context strategies within the policy module, ensuring workspace file labels persist correctly during project updates and shared path conflicts with containers are handled.

SELinux policies conflict with containers on shared paths because both attempt to enforce separate file context labels on the same directories, requiring specific file context strategies within the policy module to resolve access denials.

An SELinux policy needs essential permissions defined within the agent process domain to allow executable entrypoints, workspace file read/write access, and directory traversal while maintaining confinement to explicitly labeled project paths.