Amazon Linux 2027 Preview: SELinux Goes Default Enforcing

SELinux Shift: A Migration Wake-Up Call

The release of Amazon Linux 2027 in public preview, with SELinux enforcing by default, represents a notable shift in the security posture for AWS's cloud-optimized operating system. This move from permissive to enforcing mode in SELinux is the most significant operational change for existing users and will necessitate careful validation and potential reconfiguration for applications that previously operated under the less stringent AL2023 defaults. The lack of immediate clarity on migration paths from AL2023 and the general availability timeline also raises concerns for organizations planning their cloud infrastructure updates. While AWS positions AL2027 for a broad range of workloads, including AI/ML, the immediate focus for many will be on navigating this security change rather than exploring new kernel versions or cryptographic libraries. The community's immediate reaction, prioritizing migration over features, underscores the practical challenges adoption teams will face.

The inclusion of AWS Neuron support and the use of AWS-LC for cryptography are forward-looking enhancements, particularly for AI/ML workloads. However, the fact that the kernel version (7.1) is explicitly stated as a starting point and subject to LTS updates suggests that the final GA version might differ, adding another layer of uncertainty for long-term planning. The comparison to Oracle Linux, while highlighting the open-source nature, also brings up the broader discussion about the value proposition of Amazon Linux versus other RHEL-derived distributions. For many, the primary driver for using Amazon Linux is its tight integration and optimization within the AWS ecosystem. The success of AL2027 will hinge not only on its technical merits but also on AWS's ability to provide clear guidance and tooling for migration and ongoing management, especially concerning the SELinux enforcement.

Key Points

• Amazon Linux 2027 has entered public preview, building on the AL2023 baseline.
• The most significant change is SELinux enforcing by default, a shift from AL2023's permissive mode.
• AL2027 runs on kernel 7.1 or later and includes AWS Neuron support for AI/ML workloads.
• AWS-LC is used for cryptographic operations.
• Migration paths from AL2023 are unclear, and the GA timeline is not yet announced.
• Community feedback heavily emphasizes concerns about migration and SELinux configuration.
• AMIs are available in commercial regions for x86-64 and ARM; on-premises images are pending.

---

📖 Source: Amazon Linux 2027 Enters Public Preview with SELinux Enforcing by Default