SELinux Concepts

Internal

• SELinux

Context

• External https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/chap-Security-Enhanced_Linux-SELinux_Contexts.html

Processes and files are associated with an SELinux context that contains the SELinux user, role, type, and optionally a level. When running SELinux, this information is used to make access control decisions.

Policy

The SELinux Policy is the set of rules that tells the SELinux security engine what to do. A policy defines types for file objects and domains for processes. It uses roles to limit the domains that can be entered, and has user identities to specify the roles that can be attained. Security policies can be modified at run time via SELinux booleans.

Type and Domain

Types and domains are equivalent, the difference being that types apply to objects while domains apply to processes.

The type can be one of the following:

• targeted - Targeted processes are protected.
• minimum - Modification of targeted policy. Only selected processes are protected.
• mls - Multi Level Security protection.

It is configured with SELINUXTYPE in /etc/selinux/config.

The actual type is reported by "sestatus":

# sestatus
SELinux status:                 enabled
...
Loaded policy name:             targeted
...

Module

The list of modules can be obtained with:

semodule -l

New modules can be installed with:

semodule -i <module-name>.pp

SELinux Booleans

SELinux policy booleans are boolean values that enable or disable conditional rules. The booleans allow runtime modifications of the security policy without having to load a new policy.