Chapter 43. Security and SELinux

43.1. Access Control Mechanisms (ACMs)

43.1.1. Discretionary Access Control (DAC)
43.1.2. Access Control Lists (ACLs)
43.1.3. Mandatory Access Control (MAC)
43.1.4. Role-based Access Control (RBAC)
43.1.5. Multi-Level Security (MLS)
43.1.6. Multi-Category Security (MCS)

43.2. Introduction to SELinux

43.2.1. SELinux Overview
43.2.2. Files Related to SELinux
43.2.3. Additional Resources

43.3. Brief Background and History of SELinux

43.4. Multi-Category Security (MCS)

43.4.1. Introduction
43.4.2. Applications for Multi-Category Security
43.4.3. SELinux Security Contexts

43.5. Getting Started with Multi-Category Security (MCS)

43.5.1. Introduction
43.5.2. Comparing SELinux and Standard Linux User Identities
43.5.3. Configuring Categories
43.5.4. Assigning Categories to Users
43.5.5. Assigning Categories to Files

43.6. Multi-Level Security (MLS)

43.6.1. Why Multi-Level?
43.6.2. Security Levels, Objects and Subjects
43.6.3. MLS Policy
43.6.4. LSPP Certification

43.7. SELinux Policy Overview

43.7.1. What is the SELinux Policy?
43.7.2. Where is the Policy?
43.7.3. The Role of Policy in the Boot Process
43.7.4. Object Classes and Permissions

43.8. Targeted Policy Overview

43.8.1. What is the Targeted Policy?
43.8.2. Files and Directories of the Targeted Policy
43.8.3. Understanding the Users and Roles in the Targeted Policy

^[19] The NSA is the cryptologic agency of the United States of America's Federal government, charged with information assurance and signals intelligence. You can read more about the NSA at their website, http://www.nsa.gov/about/.

^[20] Flask grew out of a project that integrated the Distributed Trusted Operating System (DTOS ) into the Fluke research operating system. Flask was the name of the architecture and the implementation in the Fluke operating system.

^[21] Any role could have been chosen for the targeted policy, but system_r already had existing authorization for the daemon domains, simplifying the process. This was done because no mechanism currently exists to alias roles.

^[22] A user aliasing mechanism would also work here, to alias all identities from the strict policy to a single user identity in the targeted policy.