Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.

My user is confied to one category (C2), and the file is set to C3.

[test1@jsightler ~]$ id -Z

[test1@jsightler ~]$ cd /testdir/
[test1@jsightler testdir]$ ls -Z
-rw-r--r--. root root unconfined_u:object_r:default_t:s0:c3 test

[test1@jsightler testdir]$ cat test 

Why does this read succeed?


sestatus output:

[root@jsightler ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
[root@jsightler ~]#
share|improve this question
Please show the output of the sestatus command. – Kyle Jones Mar 6 '12 at 19:14
up vote 1 down vote accepted
[test1@jsightler ~]$ id -Z

Not an expert, but that doesn't look like a confined user to me. Where does it indicate to you that this user is confined? Everything in that output shows unconfined.

share|improve this answer
I was expecting the S0:C2 to be enforced, despite the user being unconfined_u. I guess these are ignored with unconfined_u, though. – jsight Mar 7 '12 at 4:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.