Policy attributes identify as groups sets of security types that have a
similar property. These groups can be controlled by fewer, overarching
rules. The relationship is many-to-many: a type can have any amount of
attributes, and an attribute can be associated with any number of types.
The declarations file $SELINUX_SRC/attrib.te is
well documented in the comment blocks. The attribute declaration syntax
is: attribute
<identifier>:
## Samples from $SELINUX_SRC/attrib.te
# The domain attribute identifies every type that can be
# assigned to a process. This attribute is used in TE rules
# that should be applied to all domains, e.g. permitting
# init to kill all processes.
attribute domain;
# Identifies all default types assigned to packets received
# on network interfaces.
attribute netmsg_type;
Here are a few noteworthy attributes. Information about these was
obtained through policy analysis using apol,
part of the setools package. You can read more about
this in
Section 6.3 Using apol for Policy Analysis.:
httpdcontent
The purpose of this attribute is to group together the various
types associated with the policy for Apache HTTP. Because of the
complexity of the httpd configuration, the targeted policy
includes Boolean values that allow you to grant blanket permissions
for httpd content types. This helps Web applications and
built-in scripting, such as PHP for Apache HTTP, to work with the
content. The types in this attribute are:
# This is an aliasing relationship
httpd_sys_content_t: httpd_sysadm_content_t, \
httpd_user_content_t
# These types handle different permissions sets for scripts
httpd_sys_script_ro_t
httpd_sys_script_rw_t
httpd_sys_script_ra_t
The first line in the attribute group specifies that
httpd_sys_content_t is an alias for
httpd_sysadm_content_t and
httpd_user_content_t.
file_type
This attribute is for all the types that are assigned to files,
allowing for easier association of all file types to various kinds
of file system needs. This attribute makes it more convenient to
allow specific domains access to all file types. The list of types
associated with the file_type
attribute is greater than 170 types:
These attributes relate to network activity by domains. The
netif_type identifies the types
associated with network interfaces, allowing policy to control
sending, receiving, and various operations on the interface:
The port_type attribute is
associated with all types that are assigned to port numbers. This
allows SELinux to control port binding, meaning daemons are restricted
in using a port depending on the type assigned to the port:
This attribute identifies all types assigned to file systems,
including non-persistent file systems. The
fs_type attribute is used in TE
rules to allow most domains to obtain overall file system
statistics, and for some specific domains to mount any file system.
Here are the SELinux file types that are part of
fs_type:
This attribute groups together all types that are assigned to
entry point executables. Any TE rules and assertions that should be
applied to all entry point executables use this attribute. Here are
the domains in this attribute:
This attribute allows for flexibility in choosing a
mail transfer agent (MTA)
such as sendmail or postfix.
Rules allow it to perform mail handling and take tasks from
mailman. However, this attribute is not used in
the targeted policy since none of the MTAs are targeted daemons for
Red Hat Enterprise Linux 4.
domain
This attribute is for all types that can be assigned to a
process. This is the method for identifying what is a domain in
SELinux. In other Type Enforcement systems, domains may be
implemented separately from types. In SELinux, domains are
essentially types with the domain
attribute.
This attribute allows you to have rules that can be applied to all
domains, such as allowing init to send signals to
all processes. Another example is the following rule that allows
all processes to perform a search on directory objects that have a
type of var_t or
var_run_t, that is, the directories
/var and /var/run:
This attribute identifies all the types that are assigned to any
of the reserved network ports, that is, ports numbered lower than
1024. The attribute is used to control binding. An example binding
rule is followed here by the types that are part of this attribute:
# The allow rule permits the domain portmap_t to bind to a
# port with a type of portmap_port_t, which is one of the
# types identified by the reserved_port_type attribute. The
# dontaudit rule tells SELinux to never audit the access of
# portmap_t to a reserved_port_type.
allow portmap_t portmap_port_t:{ udp_socket tcp_socket } \
name_bind;
dontaudit portmap_t reserved_port_type:tcp_socket name_bind;
# Types associated with the reserved_port_type attribute
http_port_t
smtp_port_t
rndc_port_t
ntp_port_t
portmap_port_t
snmp_port_t
syslogd_port_t
