Configuring Categories - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

james
daniel
root
olga
Notice that at this stage only the root account is assigned to any categories. By default, the root
account is configured with access to all categories.
Red Hat Enterprise Linux and SELinux are preconfigured with several default categories, but to make
effective use of MCS, the system administrator typically modifies these or creates further categories to
suit local requirements.

44.5.3. Configuring Categories

SELinux maintains a mapping between internal sensitivity and category levels and their human-
readable representations in the setrans.conf file. The system administrator edits this file to
manage and maintain the required categories.
Use the chcat -L command to list the current categories:
[root@dhcp-133 ~]# chcat -L
s0
s0-s0:c0.c1023
s0:c0.c1023
To modify the categories or to start creating your own, modify the /etc/selinux/<selinuxtype>/
setrans.conf file. For the example introduced above, add the Marketing, Finance, Payroll, and
Personnel categories as follows (this example uses the targeted policy, and irrelevant sections of the
file have been omitted):
[root@dhcp-133 ~]# vi /etc/selinux/targeted/setrans.conf
s0:c0=Marketing
s0:c1=Finance
s0:c2=Payroll
s0:c3=Personnel
Use the chcat -L command to check the newly-added categories:
[root@dhcp-133 ~]# chcat -L
s0:c0
s0:c1
s0:c2
s0:c3
s0
s0-s0:c0.c1023
s0:c0.c1023
Note
After you make any changes to the setrans.conf file, you need to restart the MCS
translation service before those changes take effect. Use the following command to restart
the service:
user_u
user_u
root
user_u
SystemLow-SystemHigh
SystemHigh
Marketing
Finance
Payroll
Personnel
SystemLow-SystemHigh
SystemHigh
s0
s0
s0-s0:c0.c1023
s0
Configuring Categories
735