Very rarely used statistically, but is more standard in enterprise-geared security.
Example; Oracle Linux, and (RHEL/Red Hat Enterprise Linux), are shipped out of the box with SELinux.

Gentoo is also shipped with SELinux.

Ubuntu does not provide SELinux out of the box. Instead, it uses AppArmor as its default Mandatory Access Control (MAC) system.
Debian does not provide SELinux out of the box; like Ubuntu, it defaults to AppArmor.

Treating everything as a layers in (security/hardening) is essential;
           
That means SELinux & secureboot are essential.
           
Both can be tricky to get working properly, but focusing all effort on one layer 
           
and ignoring the bottom layers is a recipe for disaster.
          

sestatus     Copy

Shows whether SELinux is enabled, enforcing, or permissive.

setenforce 0     Copy

Switches SELinux to permissive mode (logs but does not enforce policies).

setenforce 1     Copy

Switches SELinux back to enforcing mode.

This is set in the file: /etc/selinux/config it will set SELinux to Enforce mode when booting automatically.

SELINUX=enforcing     Copy

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
# See also:
#
# NOTE: Up to RHEL 8 release included, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
#    grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
#    grubby --update-kernel ALL --remove-args selinux
#
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

This is set in the file: /etc/selinux/config it will set SELinux to Permissive mode when booting automatically.

SELINUX=Permissive     Copy

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
#
# NOTE: Up to RHEL 8 release included, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
#    grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
#    grubby --update-kernel ALL --remove-args selinux
#
SELINUX=Permissive
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

This is set in the file: /etc/selinux/config it will Disable SELinux at boot automatically.

SELINUX=disabled     Copy

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
# See also:
#
# NOTE: Up to RHEL 8 release included, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
#    grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
#    grubby --update-kernel ALL --remove-args selinux
#
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

semanage port -l | grep ssh     Copy

semanage port -a -t ssh_port_t -p tcp 2222     Copy

getsebool -a | grep ssh    Copy

setsebool -P allow_ssh_keysign off         Copy

Turning off allow_ssh_keysign disables host-based authentication that uses the server’s host keys for signing data, reducing potential attack vectors.

It doesn’t impact authorized_keys, which store individual user keys.

ls -Z /path/to/file     Copy

Displays SELinux security context for files.

restorecon -Rv /path/to/directory     Copy

Resets files to correct SELinux labels.

chcon -R -t ssh_home_t /custom/path/     Copy

If SELinux blocks a SSH from accessing /custom/path, this should solve it.

This example is for sshd, seein in the ssh* part

SELinux Labels for User Home Directories and SSH/sshd

Typically, these labels include:

• user_home_dir_t: Applied to user home directories.
• user_home_t: Label for files within user home directories.
• ssh_home_t: Used for .ssh directories and related files.
• ssh_exec_t: Applied to the SSH client executable.
• sshd_exec_t: Label for the SSH daemon executable.
• sshd_config_t: For SSH daemon configuration files.

Note: These labels can vary slightly depending on the distribution and SELinux policy version.

chcon -R -t ssh_home_t /home/youruser/.ssh     Copy