< Docs | Drafts | SELinux User Guide
No edit summary |
|||
| Line 6: | Line 6: | ||
Someone suggested having a section, that detailed if you are not going to do anything else with SELinux, then at least do these 3-4 things... | Someone suggested having a section, that detailed if you are not going to do anything else with SELinux, then at least do these 3-4 things... | ||
== SELinux Contexts and Attributes == | |||
[[Docs/Drafts/SELinx User Guide/SELinux Content Specification/Contexts and Attributes| SELinux Contexts and Attributes]] | |||
== Subjects and Objects == | |||
[[Docs/Drafts/SELinx User Guide/SELinux Content Specification/Subjects and Objects| Subjects and Objects]] | |||
== Working with SELinux == | |||
[[Docs/Drafts/SELinx User Guide/SELinux Content Specification/Working with SELinux| Working with SELinux]] | |||
== Working with System Services == | |||
Apache: " avc: denied { getattr }" when file labeled with incorrect context (hook before open()?) | |||
== Access Control == | == Access Control == | ||
| Line 31: | Line 49: | ||
When using targeted policy, domains run as the <code>system_r</code> role. Type enforcement then separates each domain. | When using targeted policy, domains run as the <code>system_r</code> role. Type enforcement then separates each domain. | ||
Revision as of 01:15, 13 August 2008
Content Specification (Draft-only)
SELinux Introduction
SELinux Basics
Someone suggested having a section, that detailed if you are not going to do anything else with SELinux, then at least do these 3-4 things...
SELinux Contexts and Attributes
SELinux Contexts and Attributes
Subjects and Objects
Working with SELinux
Working with System Services
Apache: " avc: denied { getattr }" when file labeled with incorrect context (hook before open()?)
Access Control
Describe the concepts of the following, using <http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/selg-overview.html> as a guide:
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Multi-Level Security (MLS)
- Mutli-Category Security (MCS)
- Type Enforcement (TE)
- Role Based Access Control (RBAC)
SELinux rules are not checked if DAC rules deny access.
RBAC: Roles are associated with domain types, and domain types are associated with SELinux users. When not taking domain transition into account, roles do not restrict access between subjects and objects, but limit which SELinux users can exist and transition to which domains. For example, domain transition fails if the SELinux user and the new domain type are not allowed to exist in the security context that is created after a domain transition occurs. Roles are important when writing policies, but do not restrict access per se, and as such, are not discussed in detail in this guide.
Targeted Policy Overview
- Introduction to targeted policy: <http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/sec-sel-policy-targeted-oview.html>.
- Confined and unconfined processes. Explain unconfined.
- Users and roles: user_u, user_r, system_r, and so on.
When using targeted policy, domains run as the system_r role. Type enforcement then separates each domain.