SELinux provides a flexible mandatory
access control (MAC) system built
into the Linux kernel. Under standard Linux discretionary access control (DAC), an application or process running as a user
(UID or SUID) has the user's permissions to objects such as files,
sockets, and other processes. Running an SELinux MAC kernel
protects the system from malicious or flawed applications that can
damage or destroy the system. SELinux defines the access and
transition rights of every user, application, process, and file on
the system. SELinux then governs the interactions of these
subjects and objects using a security policy that specifies how strict or lenient a given
Red Hat Enterprise Linux installation should be.
For the most part, SELinux is almost completely invisible to
system users. Only system administrators must worry about how
strict a policy to implement for their server environment. The
policy can be as strict or lenient as needed, and is very finely
detailed. This detail gives the SELinux kernel complete, granular
control over the entire system.
When a subject such as an application attempts to access an
object such as a file, the policy enforcement server in the kernel
checks an access vector cache
(AVC), where subject and object
permissions are cached. If a decision cannot be made based on data
in the AVC, the request continues to the security server, which
looks up the security context of the
application and the file in a matrix. Permission is then granted or
denied, with an avc: denied
message detailed in /var/log/messages.
Subjects and objects gain their security context from installed
policy, which also provides the information to populate the
security server's matrix.
In addition to running in an enforcing
mode, SELinux can run in a permissive
mode, where the AVC is checked and denials are logged, but SELinux
does not enforce the policy.
For more information about how SELinux works, refer to Section 21.3 Additional
Resources.
