I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.

My user is confied to one category (C2), and the file is set to C3.

[test1@jsightler ~]$ id -Z

[test1@jsightler ~]$ cd /testdir/
[test1@jsightler testdir]$ ls -Z
-rw-r--r--. root root unconfined_u:object_r:default_t:s0:c3 test

[test1@jsightler testdir]$ cat test 

Why does this read succeed?


sestatus output:

[root@jsightler ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
[root@jsightler ~]#
  • Please show the output of the sestatus command.
    – Kyle Jones
    Mar 6 '12 at 19:14
[test1@jsightler ~]$ id -Z

Not an expert, but that doesn't look like a confined user to me. Where does it indicate to you that this user is confined? Everything in that output shows unconfined.

  • I was expecting the S0:C2 to be enforced, despite the user being unconfined_u. I guess these are ignored with unconfined_u, though.
    – jsight
    Mar 7 '12 at 4:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.