SELinux
=======

Security Contexts
-----------------

SELinux-User:Role:Type

+ SELinux maintains its own user list. (e.g. root_u, user_u)
+ Roles, for example: sysadmin_r for system administration
+ Types, for example: mail_t, database_t

Subjects -> Processes
Object   -> Files,
            Directories,
            Block Devices,
            Character Devices,
            Network Interfaces,
            TCP Sockets

Process context (for example):     Object context (for example some file):
    (user_u:sysadmin_r:mail_t)       (user_u:user_r:mail_t)

Note: The type of a process is also called the process's domain.
Note: Contexts are also called labels.

Two Kinds of Decisions
----------------------

- Access Decision
  Can given subject perform given action on the given object?
  "Can Firefox write to its bookmark file?"

  SELinux returns an answer that is an "access vector" with one bit for each possible action:
     Allow
     Allow with audit
     Deny
     Deny with audit (default)

- Transition Decision
  What label should be applied to a new object?
  For example: files in a directory are labeled like the directory by default.

  Type of creating process + Type of related object => Type of new object.


  When does a new process get a label different from its parent?
  For example: child processes get the same label as their parent

  Type of parent process + Type of executable file => Type of child process


Requirements
------------

+ Kernel module for SELinux
+ Shared library for an API
+ Tools that use the above API to get things done (such as viewing or setting file labels)
+ Policy
+ Labeled file system