Red Hat ENTERPRISE LINUX 4 - SELINUX GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 2.SELinux Policy OverviewThis chapter is an overview of SELinux policy, some of its internals, and how it works. This chapterdiscusses the policy in a more general way, where Chapter 3 Targeted Policy Overview focuses on thedetails of the targeted policy as it ships in Red Hat Enterprise Linux. This chapter starts with a briefoverview of what policy is and where it resides. Next, the role of SELinux during boot is discussed.This is followed by discussions on file security contexts, object classes and permissions, attributes,types, access vectors, macros, users and roles, constraints, and a brief discussion summarizing specialkernel interfaces.To see all of the details discussed in this chapter, you must make sure you have installed the policysource and binary packages for the targeted policy:• selinux-policy-targeted-sources- version• selinux-policy-targeted- versionImportantWhen you have the policy sources installed, rpm may assume that you have modified the policy andmay not automatically load a newly installed policy. This occurs if you have ever loaded the policyfrom source, that is, run make load, make reload, or make install. New binary policy packagesinstall policy. XY as, for example, $SELINUX_POLICY/policy.18.rpmnew.If you have not modified the policy or want to use the binary policy package, you can mvpolicy.18.rpmnew policy.18, then touch /.autorelabel and reboot. If you have modified thepolicy and want to load your modifications, you must upgrade the policy source package and makeload. Policy building is discussed in Chapter 7 Compiling SELinux Policy .If you have only built the policy but never loaded it, that is, have only run make policy, you should notrun into this situation. The binary policy installs cleanly, knowing that you are not running a custompolicy.Work is ongoing to improve package installation logic so the entire process is automated by rpm.Expect this to be included in a future update to Red Hat Enterprise Linux 4.2.1. What Is Policy?Policy is the set of rules that guide the SELinux security engine. It defines types for file objects anddomains for processes, uses roles to limit the domains that can be entered, and has user identities tospecify the roles that can be attained. A domain is what a type is called when it is applied to a process.A type is a way of grouping together like items based on their fundamental security sameness. Thisdoesn’t necessarily have to do with the unique purpose of an application or the content of a document.For example, an object such as a file can have any type of content and be for any purpose, but if itbelongs to a user and lives in that user’s home directory, it is considered to be of a specific securitytype, user_home_t.These object types gain their sameness because they are accessible in the same way by the same set ofsubjects. Similarly, processes tend to be of the same type if they have the same permissions as othersubjects. In the targeted policy, programs that run in the unconfined_t domain have an executablewith a type such as sbin_t. From an SELinux perspective, that means they are all equivalent in termsof what they can and cannot do on the system.