SELinux provides a flexible mandatory access
control (MAC) system built into the Linux
kernel. Under standard Linux discretionary access
control (DAC), an application or process
running as a user (UID or SUID) has the user's permissions to objects
such as files, sockets, and other processes. Running an SELinux MAC
kernel protects the system from malicious or flawed applications that
can damage or destroy the system. SELinux defines the access and
transition rights of every user, application, process, and file on the
system. SELinux then governs the interactions of these
subjects and objects
using a security policy that specifies how
strict or lenient a given Red Hat Enterprise Linux installation should be.
For the most part, SELinux is almost completely invisible to system users.
Only system administrators must worry about how strict a policy to
implement for their server environment. The policy can be as strict or
lenient as needed, and is very finely detailed. This detail gives the
SELinux kernel complete, granular control over the entire system.
When a subject such as an application attempts to access an object such
as a file, the policy enforcement server in the kernel checks an
access vector cache (AVC), where
subject and object permissions are cached. If a decision cannot be made
based on data in the AVC, the request continues to the security server,
which looks up the security context of the
application and the file in a matrix. Permission is then granted or
denied, with an avc: denied message
detailed in /var/log/messages. Subjects and
objects gain their security context from installed policy, which also
provides the information to populate the security server's matrix.
In addition to running in an enforcing mode,
SELinux can run in a permissive mode, where the AVC
is checked and denials are logged, but SELinux does not enforce the policy.
For more information about how SELinux works, refer to Section 21.3 Additional Resources.
