Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.

My user is confied to one category (C2), and the file is set to C3.

[test1@jsightler ~]$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0:c2

[test1@jsightler ~]$ cd /testdir/
[test1@jsightler testdir]$ ls -Z
-rw-r--r--. root root unconfined_u:object_r:default_t:s0:c3 test


[test1@jsightler testdir]$ cat test 
adfasdfadsfas

Why does this read succeed?

EDIT:

sestatus output:

[root@jsightler ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
[root@jsightler ~]#
share|improve this question
    
Please show the output of the sestatus command. –  Kyle Jones Mar 6 '12 at 19:14
add comment

1 Answer 1

up vote 1 down vote accepted
[test1@jsightler ~]$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0:c2

Not an expert, but that doesn't look like a confined user to me. Where does it indicate to you that this user is confined? Everything in that output shows unconfined.

share|improve this answer
    
I was expecting the S0:C2 to be enforced, despite the user being unconfined_u. I guess these are ignored with unconfined_u, though. –  jsight Mar 7 '12 at 4:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.