I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.

My user is confied to one category (C2), and the file is set to C3.

[test1@jsightler ~]$ id -Z

[test1@jsightler ~]$ cd /testdir/
[test1@jsightler testdir]$ ls -Z
-rw-r--r--. root root unconfined_u:object_r:default_t:s0:c3 test

[test1@jsightler testdir]$ cat test 

Why does this read succeed?


sestatus output:

[root@jsightler ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
[root@jsightler ~]#
  • Please show the output of the sestatus command.
    – Kyle Jones
    Mar 6, 2012 at 19:14

1 Answer 1

[test1@jsightler ~]$ id -Z

Not an expert, but that doesn't look like a confined user to me. Where does it indicate to you that this user is confined? Everything in that output shows unconfined.

  • I was expecting the S0:C2 to be enforced, despite the user being unconfined_u. I guess these are ignored with unconfined_u, though.
    – jsight
    Mar 7, 2012 at 4:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .