In-depth exploration of the three policy classifications of SELinux

SELinux is a mandatory access control security technology used to enhance the security of Linux operating systems. In SELinux, policies are divided into three main categories: Targeted Policy, MLS/MCS Policy, and Custom Policy. These three policy classifications play an important role in the security mechanism of SELinux. This article will introduce these three policy classifications in detail with specific code examples.

1. Targeted Policy
   Targeted policy is the most commonly used policy classification in SELinux, which restricts access permissions based on the relationship between users, programs, and processes. In the target policy, only a few users or processes are defined as security policies, and other users or processes inherit the default policy. By assigning roles and permissions to these users or processes, you can effectively control their access rights.

The following is a sample code that demonstrates how to use a target policy to restrict a user's access to a file:

# 创建一个测试文件
touch testfile.txt

# 为该文件设置安全上下文
chcon system_u:object_r:admin_home_t:s0 testfile.txt

# 创建一个用户
useradd testuser

# 给该用户分配角色和权限
semanage user -a -R "staff_r system_r" testuser

# 切换用户至 testuser
su testuser

# 尝试读取文件
cat testfile.txt

2. Multiple policies (MLS/MCS Policy)
   Multi-policy is a more stringent policy classification that can achieve more fine-grained security control. In MLS (Multi-Level Security) and MCS (Multi-Category Security) policies, files and processes are divided into different access control domains based on their security levels or categories, thereby achieving access control between each domain.

The following is a sample code that demonstrates how to set the security level of a file in an MLS policy:

# 创建一个测试文件
touch testfile.txt

# 为该文件设置安全等级
setfattr -n security.selinux -v "s0:c0,c1" testfile.txt

# 查看文件的安全等级
getfattr -n security.selinux testfile.txt

3. Custom Policy (Custom Policy)
   The custom policy is Refers to policies customized according to specific needs to achieve personalized security control. By writing custom policy modules and related rules, the default behavior of SELinux can be customized to meet specific security requirements.

The following is a sample code that demonstrates how to write a simple SELinux custom policy module:

#include <selinux/selinux.h>
#include <selinux/label.h>

int main() {
    security_context_t scontext, tcontext;
    char *class = "file";
    char *perms = "read";
    security_id_t sid, tid;

    int rc = getfilecon("/etc/passwd", &scontext);
    if (rc < 0) {
        perror("getfilecon");
        return 1;
    }

    rc = security_compute_user(scontext, &sid, &tcontext);
    if (rc < 0) {
        perror("security_compute_user");
        return 1;
    }

    rc = security_compute_av(sid, class, perms, &tid);
    if (rc < 0) {
        perror("security_compute_av");
        return 1;
    }

    printf("Source context: %s
", tcontext);
    printf("Target context: %s
", tcontext);

    return 0;
}

Through the above example, we understand the target policy, multi-policy and custom policy of SELinux It is introduced in detail and provides specific code examples. By understanding and mastering these policy classifications, users can have a deeper understanding of the security mechanism of SELinux and better apply it to actual system security control.

The above is the detailed content of In-depth exploration of the three policy classifications of SELinux. For more information, please follow other related articles on the PHP Chinese website!