From SELinux Wiki

Revision as of 15:19, 29 October 2009 by ChrisPeBenito (Talk | contribs)
Jump to: navigation, search

SELinux Context

Every process and object in the system has a context (alternatively referred to as a label). This is an attribute used to determine if an access should be allowed between a process and an object. For example, a user process might have the context of user_u:user_r:user_t, and file in the user's home directory might have the context user_u:object_r:user_home_t. A SELinux context consists of three required fields, and one optional field.

The first field is the SELinux user. The SELinux user is not equivalent to a Linux user. Typically many Linux users will use the same SELinux user, but it is possible to have a 1:1 Linux user to SELinux user mapping, such as the root Linux user and the root SELinux user. One significant difference between the SELinux users and Linux users is SELinux users do not change during a user session, whereas a Linux user might change via su or sudo. By convention, SELinux users that are generic have the suffix "_u", such as user_u.



The forth field is the MLS range. This field will be discussed later.

Object Classes


Personal tools