Comparing Selinux And Standard Linux User Identities - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 44. Security and SELinux
MCS works on a simple principle: to access a file, a user needs to be assigned to all of the categories
with which the file is labeled. The MCS check is applied after normal Linux Discretionary Access
Control (DAC) and Type Enforcement (TE) rules, so it can only further restrict security.

44.5.2. Comparing SELinux and Standard Linux User Identities

SELinux maintains its own user identity for processes, separately from Linux user identities. In the
targeted policy (the default for Red Hat Enterprise Linux), only a minimal number of SELinux user
identities exist:
• system_u — System processes
• root — System administrator
• user_u — All login users
Use the semanage user -l command to list SELinux users:
[root@dhcp-133 ~]# semanage user -l
Labeling
SELinux User Prefix
root user
system_u user
user_u user
Section 44.8.3, "Understanding the Users and Roles in the Targeted Policy"
Refer to
information about SELinux users and roles.
SELinux Logins
One of the properties of targeted policy is that login users all run in the same security context. From a
TE point of view, in targeted policy, they are security-equivalent. To effectivly use MCS, however, we
need to be able to assign different sets of categories to different Linux users, even though they are all
the same SELinux user (user_u). This is solved by introducing the concept of an SELinux login. This
is used during the login process to assign MCS categories to Linux users when their shell is launched.
Use the semanage login -a command to assign Linux users to SELinux user identities:
[root@dhcp-133 ~]# semanage login -a james
[root@dhcp-133 ~]# semanage login -a daniel
[root@dhcp-133 ~]# semanage login -a olga
Now when you list the SELinux users, you can see the Linux users assigned to a specific SELinux
user identity:
[root@dhcp-133 ~]# semanage login -l
Login Name
__default__
734
MLS/ MLS/
MCS Level MCS Range
s0 s0-s0:c0.c1023
s0 s0-s0:c0.c1023
s0 s0-s0:c0.c1023
SELinux User
user_u
SELinux Roles
system_r sysadm_r user_r
system_r
system_r sysadm_r user_r
MLS/MCS Range
s0
for more