Security labels are an indication SELinux needs to do its job. Think of them as a very, very far generalization of file permissions and ownership. It's SELinux that improves security, not the security labels in themselves.
Security labels are metadata associated to files. They have the form user:role:type[:level[:category]]
. For comparison, traditional Unix permissions have the form user:group rwxrwxrwx
. The security label on a file specifies its SELinux context.
- SELinux users correspond to different system components that may have different permissions. They can correspond to users of the the Linux system, but that is mostly the case for system users: it is typical for all real users to be lumped under a single SELinux user.
- Roles correspond to a class of actions that a class of users may perform. They are used to implement role-based access control.
- Types correspond to a particular action or resource (or set thereof) whose access is restricted.
- Levels implement multilevel security.
- Categories implement multi-categories security.
Running processes have a security context which is computed from the security label on the executable and the context of the caller. Files also have a security context which is computed from their security label. When a subject (process) attempts to access an object (file), the kernel checks whether the SELinux policy allows the subject's context to access the object.
Writing an SELinux policy is very complex if you want it to let you actually run the system, let alone provide additional security. This is why not many Linux systems have adopted SELinux in enforcing mode.
For more information, see: