I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.
My user is confied to one category (C2), and the file is set to C3.
[test1@jsightler ~]$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0:c2
[test1@jsightler ~]$ cd /testdir/
[test1@jsightler testdir]$ ls -Z
-rw-r--r--. root root unconfined_u:object_r:default_t:s0:c3 test
[test1@jsightler testdir]$ cat test
adfasdfadsfas
Why does this read succeed?
EDIT:
sestatus output:
[root@jsightler ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted
[root@jsightler ~]#
sestatus
command.