Enterprise Cloud Security and Governance

Process confinement

All processes have SELinux context associated with them. We will understand this with an example:

Whenever we install a web server, the default location for the document root is in the /var/www/html directory. The SELinux policies are such that whenever we have our application in /var/www/html, the web server (Apache, nginx) will be able to have access to these files.

Let's create a test file in /var/www/html and see what the permissions associated are:

[root@localhost ~]# touch /var/www/html/test.txt [root@localhost ~]# ls -Z /var/www/html/test.txt -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/test.txt

Notice the type associated with the file is httpd_sys_content_t, which means that ...