SELinux File and Process Contexts
One objective covering files and processes. The whole of SELinux, for exam purposes, is that a process has a type and a file has a type, and policy either allows that pair or does not. Everything else in this track is about reading or changing one of those two types.
Security and SELinux Guide 56 of 67 Beginner
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 11 min
A context is user:role:type:level. On the targeted policy the type is what matters and the other three rarely change - which is why the shorthand "the context" almost always means the type field, and why every fix in this track is -t <something>_t.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this for one objective covering both files and processes. This matters because everything on the system carries a context - you, your files, and the processes you run - and a confined process has a different one from you.
- reading your own context, your files' and your processes'
- reading the context of a confined process
- seeing the difference between confined and unconfined
Before you start
- A sudo-capable account.
- The session installs
httpdto have a confined process to look at, and removes it.
-
You, your files and your processes
-
A confined process