Enterprise Cloud Security and Governance

Permission sets in SELinux

We understood that depending on the permissions associated with the process and the file, the access can either be granted or denied. One may be wondering how exactly this is decided, so let's take a look into this.

The permissions are associated with all the subjects and objects in an SELinux enforced system. These permission are called SELinux context. There are three mandatory fields and one optional field that forms a context:

user:role:type:range

Before we go ahead and understand what each of the fields mean, let's explore the security context of various files within the Linux system:

• In here we see that SELinux context associated with a file named file1:

        ~]$ ls -Z file1 -rwxrw-r-- kplabs kplabs unconfined_u:object_r:user_home_t:s0 ...