3.1. What is the Targeted Policy?

The SELinux policy is highly configurable. For Red Hat Enterprise Linux 4, Red Hat supports a single policy, the targeted policy. Under the targeted policy, every subject and object runs in the unconfined_t domain except for the specific targeted daemons. The objects on the system that are in the unconfined_t domain are allowed by SELinux to have no restrictions and fall back to using standard Linux security, that is, DAC. This policy is flexible enough to fit into enterprise infrastructures. The daemons that are part of the targeted policy run in their own domains and are restricted in every operation they perform on the system. This way daemons that are broken or exploited are limited in the damage they can do.

The opposite of the targeted policy is the strict policy. This does not ship with Red Hat Enterprise Linux. In the strict policy, every subject and object are in a specific security domain, with all interactions and transitions individually considered within the policy rules. This is a much more complex environment.

This guide focuses on the targeted policy that comes with Red Hat Enterprise Linux, and the components of SELinux used by the targeted daemons.

The targeted daemons are:

• dhcpd — this policy is dissected and explained in Chapter 4 Example Policy Reference - dhcpd.

• httpd

• mysqld

• named

• nscd

• ntpd

• portmap

• postgres

• snmpd

• squid

• syslogd

• winbind

The policy can be manipulated using command line or GUI tools. This is discussed extensively in Chapter 5 Controlling and Maintaining SELinux. Chapter 6 Tools for Manipulating and Analyzing SELinux and Chapter 7 Compiling SELinux Policy are two other chapters that detail working with the targeted policy.