Guide/Contexts - Revision history

Jaxelson: /* Contexts */ linking selinux contexts

2010-09-13T23:26:33Z

Contexts - linking selinux contexts

←Older revision		Revision as of 23:26, 13 September 2010
Line 1:		Line 1:
	== Contexts ==		== Contexts ==

-	SELinux contexts are composed of 4 pieces: selinux user, role, type, and range.	+	[[SELinux contexts]] are composed of 4 pieces: selinux user, role, type, and range.

	<pre>		<pre>

CalebCase: /* Changing Contexts */

2009-07-09T20:45:04Z

Changing Contexts

←Older revision		Revision as of 20:45, 9 July 2009
Line 76:		Line 76:
	$ ls -Z /tmp/myfile		$ ls -Z /tmp/myfile
	unconfined_u:object_r:user_home_t:s0 /tmp/myfile		unconfined_u:object_r:user_home_t:s0 /tmp/myfile
		+	</pre>
		+
		+	... a file (persistently across relabels):
		+
		+	<pre>
		+	# touch /var/cache/myfile
		+	# ls -Z /var/cache/myfile
		+	unconfined_u:object_r:var_t:s0 /var/cache/myfile
		+	# semanage fcontext -a -t user_home_t /var/cache/myfile
		+	# restorecon /var/cache/myfile
		+	# ls -Z /var/cache/myfile
		+	system_u:object_r:user_home_t:s0 /var/cache/myfile
	</pre>		</pre>

CalebCase at 15:04, 26 June 2009

2009-06-26T15:04:06Z

←Older revision		Revision as of 15:04, 26 June 2009
Line 1:		Line 1:
	== Contexts ==		== Contexts ==
		+
		+	SELinux contexts are composed of 4 pieces: selinux user, role, type, and range.
		+
		+	<pre>
		+	unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255
		+	user : role : type : range
		+	</pre>
		+
		+	The selinux range is composed of a low and high level:
		+
		+	<pre>
		+	s0-s0:c0.c255
		+	low-high
		+	</pre>
		+
		+	Each level is composed a MLS sensitivity and a set of categories:
		+
		+	<pre>
		+	s0:c0.c255
		+	sensitivity:categories
		+	</pre>
		+
		+	Categories are can be specified individually:
		+
		+	<pre>
		+	c0,c5,c10
		+	</pre>
		+
		+	Or treated as an ordered set:
		+
		+	<pre>
		+	c0.c10
		+	</pre>
		+
		+	Where this would mean all categories between c0 and c10 (inclusive).

	=== Displaying Contexts ===		=== Displaying Contexts ===
Line 60:		Line 95:
	$ id -Z		$ id -Z
	system_u:system_r:crond_t:s0:c0.c255		system_u:system_r:crond_t:s0:c0.c255
		+	</pre>
		+
		+	=== Resetting Contexts ===
		+
		+	Reset the context of...
		+
		+	... a file:
		+
		+	<pre>
		+	$ restorecon /tmp/myfile
	</pre>		</pre>

CalebCase at 14:09, 26 June 2009

2009-06-26T14:09:23Z

←Older revision		Revision as of 14:09, 26 June 2009
Line 1:		Line 1:
-	=== Contexts ===	+	== Contexts ==

-	==== Displaying Contexts ====	+	=== Displaying Contexts ===

	Display the context of...		Display the context of...
Line 28:		Line 28:
	</pre>		</pre>

-	==== Changing Contexts ====	+	=== Changing Contexts ===

	Change the context of...		Change the context of...

CalebCase: New page: === Contexts === ==== Displaying Contexts ==== Display the context of... ... your shell:

 $ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255

... a file:

 $...

2009-06-26T14:05:29Z

New page: === Contexts === ==== Displaying Contexts ==== Display the context of... ... your shell: <pre> $ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255 </pre> ... a file: <pre> $...

New page

=== Contexts ===

==== Displaying Contexts ====

Display the context of...

... your shell:

<pre>
$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255
</pre>

... a file:

<pre>
$ ls -Z /bin/bash
system_u:object_r:shell_exec_t:s0 /bin/bash
</pre>

... a process:

<pre>
$ ps -Z
LABEL PID TTY TIME CMD
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255 23912 pts/3 00:00:00 bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255 25101 pts/3 00:00:00 ps
</pre>

==== Changing Contexts ====

Change the context of...

... a file:

<pre>
$ touch /tmp/myfile
$ ls -Z /tmp/myfile
unconfined_u:object_r:user_tmp_t:s0 /tmp/myfile
$ chcon -t user_home_t /tmp/myfile
$ ls -Z /tmp/myfile
unconfined_u:object_r:user_home_t:s0 /tmp/myfile
</pre>

... your shell:

<pre>
$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255
$ newrole -r system_r -t unconfined_t
Password:
$ id -Z
unconfined_u:system_r:unconfined_t:s0-s0:c0.c255
</pre>

... a program when started (temporary):

<pre>
$ runcon system_u:system_r:crond_t:s0:c0.c255 /bin/bash
$ id -Z
system_u:system_r:crond_t:s0:c0.c255
</pre>