1

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.

On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-selinux.html#s2-SELinux-files-selinux like member file.

The first thing I said to myself is it's dangerous because someone who not allowed which can modify theses files. But I tried, and I can't.

I think it's because the labels are system_u:object_r:security_t:s0 and when I tape id -Z, the result is unconfined_u:unconfined_u:unconfined_u:s0-s0:c0.c1023

Is it because I am on unconfined_u context that I can't write in this file ? Is it not dangerous to keep with 666 permission ? If that I said is incorrect, can you explain me why ? Thanks.

1

SELinux contexts come in addition to permissions and ownership. In order to access a file, a process needs to have the privileges given by ownership and to pass the checks made by SELinux. To take an extreme example, it's possible to create a root account (user ID 0) on a machine where SELinux confines this account so much that it can't make use of root privileges for anything. A file with permissions 666 but an SELinux context that prevents access is perfectly safe.

This doesn't mean that relying solely on SELinux to control access is risk-free. It's perfectly fine as long as the file isn't changed, but if the file is edited, or copied, or backed up, or otherwise affected by a tool that doesn't support SELinux then the SELinux context could be lost. Furthermore SELinux is notoriously hard to configure correctly; permissions are a lot easier to understand and audit. You should treat it as a second line of defense.

In the case of /selinux, that's a special filesystem which exposes information and controls related to the SELinux configuration. It's designed and populated by the people who make SELinux, so the risk that it's misconfigured is very low. It isn't going to be backed up or edited. So the risks of SELinux lack of support or misconfiguration do not apply. /selinux is part of how SELinux works and is not dangerous.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy