Amazon Linux 2027 Enters Public Preview With SELinux Enforcing by Default

Overview

AWS has released Amazon Linux 2027 (AL2027) in public preview, calling it “the next version of the Amazon Linux operating system, purpose-built for cloud-native workloads on AWS with performance, scale, and security in mind,” according to AWS. Built on the AL2023 baseline, AL2027 is the first Amazon Linux release to switch SELinux to enforcing mode by default, a change AWS and InfoQ both cover as the release’s central shift for operators.

What We Know

AWS says the new distribution is designed “for customers running web applications, databases, containerized microservices, AI/ML workloads, and large-scale infrastructure who need a secure, stable, and AWS-native operating system,” according to AWS. On specifications, AWS states that “AL2027 runs on kernel 7.1+, enables SELinux in enforcing mode as default, accelerates cryptographic performance with AWS-LC, and keeps builders current with the latest toolchains and language runtimes,” and that for AI and machine learning workloads “it delivers access to accelerator drivers, including AWS Neuron driver support,” per AWS.

Preview AMIs are available through the AWS Management Console “across all commercial AWS Regions, with both x86-64 and ARM variants,” and container base images are available on the Amazon ECR Public Gallery, according to AWS. On-premises images are not yet available, according to InfoQ.

The SELinux change is the release’s operational fault line. AL2023 ships SELinux in permissive mode, “where policy violations are logged rather than blocked. Applications that run on AL2023 because SELinux only complained about their behavior will fail on AL2027 unless their file contexts, ports, and access patterns match policy,” according to InfoQ. InfoQ also reports that the kernel version is not final: citing a LinkedIn discussion, InfoQ says Benjamin Herrenschmidt, a principal engineer at AWS, indicated the kernel will keep being updated until it reaches long-term support status, meaning kernel 7.1 is a starting point rather than what AL2027 ships with at general availability, according to InfoQ.

Customers can submit feedback through the AL2027 GitHub repository, and AWS has published a list of changes relative to AL2023 in the AL2027 documentation, according to AWS.

What We Don’t Know

Neither AWS’s announcement nor InfoQ’s coverage states when AL2027 will reach general availability or when AL2023 support will end. AWS also has not confirmed whether an in-place migration path from AL2023 to AL2027 will exist: in a Reddit discussion of the release, a commenter’s question about in-place migration drew more upvotes than any other comment in the thread and went unanswered by AWS, according to InfoQ.

Analysis

AWS frames the public preview as a chance for customers to “experiment with new features, validate their applications, and provide direct feedback to the Amazon Linux team” ahead of general availability, according to AWS. For teams currently on AL2023, that validation work centers on SELinux rather than new features: because AL2023’s permissive mode only logs policy violations, workloads that quietly depended on SELinux never actually blocking them are the ones most likely to break once enforcing mode becomes the default on AL2027, according to InfoQ.