> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List and Identify SELinux file and process contexts
> This article explores how SELinux enhances security by managing file and process contexts beyond standard Linux permissions.
In this article, we'll explore how SELinux manages file and process contexts, offering an extra layer of security that goes beyond standard Linux file permissions. Traditional permissions (read, write, execute) are essential, but they may not fully protect your system against sophisticated attacks. SELinux enhances system security by confining processes and applying strict mandatory access control policies.
For example, imagine a web server running within a dedicated directory. If an attacker compromises the web server, they inherit its directory permissions, potentially exploiting system vulnerabilities. SELinux prevents this by isolating processes through detailed security contexts based on SELinux labels. On systems like CentOS Stream, SELinux is enabled by default, ensuring that even if a process is breached, its actions remain confined.
## Viewing Standard Permissions
The basic Linux command `ls -l` can be used to display the standard file and directory permissions:
```bash theme={null}
$ ls -l
-rw-rw-r--. 1 aaron aaron 160 Dec 1 18:19 archive.tar.gz
```
This output shows the read, write, and execute permissions for a file. In contrast, SELinux labels provide a more granular form of security.
## Understanding SELinux Context Labels
SELinux introduces an additional security layer by assigning each file and process a security context label. This label comprises four components in the following order: user, role, type, and level. Consider the example label below:
```text theme={null}
unconfined_u:object_r:user_home_t:s0
```
* **User**: `unconfined_u`\
Represents the SELinux user defined within the SELinux policy, which may differ from the Linux login username.
* **Role**: `object_r`\
Specifies the role that helps determine permitted operations.
* **Type**: `user_home_t`\
Defines the allowed operations for the file or process and effectively serves as a security "jail."
* **Level**: `s0`\
Often used for multi-level security in organizations, indicating the sensitivity level of the object.
When an action is initiated, SELinux evaluates it by sequentially checking the SELinux user, role, and type/domain. This layered methodology ensures that only authorized processes access specific domains, thereby denying unauthorized actions.
Remember: In SELinux, only files with the correct type (e.g., `sshd_exec_t` for SSH daemon) can initiate a process that transitions into the corresponding security domain.
## Exploring Process Contexts
Processes also carry SELinux security contexts. You can check the SELinux labels for running processes using the `ps` command with the `-Z` option:
```bash theme={null}
$ ps axZ
system_u:system_r:accountsd_t:s0 995 ? Ssl 0:00 /usr/libexec/accoun
system_u:system_r:NetworkManager_t:s0 1024 ? Ssl 0:00 /usr/sbin/NetworkMa
system_u:system_r:sshd_t:s0-s0:c0.c1023 1030 ? Ss 0:00 /usr/sbin/sshd -D
system_u:system_r:tuned_t:s0 1032 ? Ssl 0:00 /usr/libexec/platfo
system_u:system_r:cupsd_t:s0-s0:c0.c1023 1033 ? Ss 0:00 /usr/sbin/cupsd -l
```
In this listing, observe that the SSH daemon (`sshd`) runs within the `sshd_t` domain. Strict policies enforce that only files labeled with the correct type (in this case, often `sshd_exec_t`) can start a process that enters this domain. Conversely, processes running with the `unconfined_t` label operate with minimal restrictions.
## Viewing the Current User’s SELinux Context
To determine your current SELinux security context, use the `id` command with the `-Z` option:
```bash theme={null}
$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
```
This output indicates how your login maps into the SELinux policy. To see how Linux users are mapped to SELinux users, execute:
```bash theme={null}
$ sudo semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
```
The default mapping assigns non-root users to the `unconfined_u` SELinux user, ensuring that even root processes are subject to the same security policies.
## Checking SELinux Enforcement Status
To check if SELinux is actively enforcing its security policies, use the `getenforce` command:
```bash theme={null}
$ getenforce
Enforcing
```
The possible outputs are:
* **Enforcing**: SELinux policies are enforced, and unauthorized actions are blocked.
* **Permissive**: SELinux is not actively enforcing policies but logs actions that would have been denied.
* **Disabled**: SELinux is turned off, and no access control is performed.
## Summary
This article has outlined how SELinux uses security context labels to provide robust access control for both files and processes. By examining the SELinux user, role, and type/domain—and considering the security level—SELinux creates a comprehensive security framework that limits potential damage from compromised processes. This granular approach is essential for maintaining the integrity of your system in the face of modern cyber threats.
For further details and practical exercises to strengthen your understanding of SELinux and its use in securing Linux systems, continue exploring related documentation and hands-on tutorials.
## Further Reading
* [Kubernetes Basics](https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/)
* [SELinux Project Wiki](https://selinuxproject.org/page/Main_Page)
* [Linux Security Modules Documentation](https://www.kernel.org/doc/html/latest/security/LSM.html)