I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
From the Gentoo Wiki's topic titled: 2. SELinux Concepts.
As expected, the security context of the user (to be more specific, the domain in which it resides) has write access to the domain of the target's directories. The notion of domain is frequently used in SELinux documentation and refers to the type assigned to a process. BTW, as files do not have roles, they are given the default object_r role by SELinux.
The key bit from that paragraph is this sentence:
The notion of domain is frequently used in SELinux documentation and refers to the type assigned to a process
If you now look at what types are from this section of the same topic: 2.b. Security Contexts - Users, Roles, Domains, Sensitivities and Categories
This is the type assigned to the resource and is the key to SELinux' enforcement rules
Putting it together
Finally, if you take a look at this section titled: 2.c. Type Enforcements / Domain Types, it connects the dots:
To explain how the permission rules work and how this is enforced through the security contexts, let's start from the last definition in the context (the type) and work our way forward through the roles and users.
- A SELinux type is a particular label assigned to a resource. The passwd command for instance is labeled with the passwd_exec_t type.
- A SELinux domain is the security state of a process and identifies the rights and permissions it has. It is most often referred to by its type declaration. For instance, for a running passwd command, its domain is passwd_t.
An example for the *passwd_t* domain would be the permissions granted between the *passwd_t* domain and the *shadow_t* type (used by the