Selinux in a sentence

Originally, the patches that make up SELinux had to be explicitly applied to the Linux kernel source; SELinux has been merged into the Linux kernel mainline in the 2.6 series of the Linux kernel.

A Linux kernel integrating SELinux enforces mandatory access-control policies that confine user programs' and system servers' access to files and network resources.

Because AppArmor and SELinux differ radically from one another, they form distinct alternatives for software control.

Files, network ports, and other hardware also have an SELinux context, consisting of a name, role (seldom used), and type.

For every current user or process, SELinux assigns a three string context consisting of a username, role, and domain (or type).

For example, AppArmor's set of operations consist of: read, write, append, execute, lock, and link. citation Most SELinux implentations will support numbers of operations orders of magnitude more than that.

In contrast, the security of a "modified" system (based on an SELinux kernel) depends primarily on the correctness of the kernel and its security-policy configuration.

Ordinary user-processes often run in the unconfined domain, not restricted by SELinux but still restricted by the classic Linux access rights.

SELinux (by default in most implementations) uses a combination of flat files (used by administrators and developers to write human readable policy before it's compiled) and extended attributes.

SELinux was designed to demonstrate the value of mandatory access controls to the Linux community and how such controls could be added to Linux.

The command runcon allows for the launching of a process into an explicitly specified context (user, role and domain), but SELinux may deny the transition if it is not approved by the policy.

The policy files are either hand written or can be generated from the more user friendly SELinux management tool.

The security of an "unmodified" Linux system (a system without SELinux) depends on the correctness of the kernel, of all the privileged applications, and of each of their configurations.

The SELinux context for a remote file system can be specified explicitly at mount time.

The SELinux project at the United States National Security Agency is an example of a federally funded free software project.

These three files must be compiled together with the SELinux tools to produce a single policy file.

The United States National Security Agency (NSA), the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000.

This means that, for example, a file that is inaccessible may become accessible under AppArmor when a hard link is created to it, while SELinux would deny access through the newly created hard link.

This system is more flexible than normally required: as a rule, most of the real users share the same SELinux username, and all access control is managed through the third tag, the domain.

Users, policies and security contexts SELinux users and roles do not have to be related to the actual system users and roles.