2 - Raspberry PI Community Projects

Figure 14.3
Security contexts and Unix users
In practice, during login, the user gets assigned a default security context (depending on the
roles that they should be able to endorse). This defines the current domain, and thus the domain
that all new child processes will carry. If you want to change the current role and its
associated domain, you must call newrole -r role_r -t domain_t (there's usually only a
single domain allowed for a given role, the -t parameter can thus often be left out). This command
authenticates you by asking you to type your password. This feature forbids programs to
automatically switch roles. Such changes can only happen if they are explicitly allowed in the
SELinux policy.
Obviously the rights do not apply to all objects (files, directories, sockets, devices, etc.). They
can vary from object to object. To achieve this, each object is associated to a type (this is known
as labeling). Domain's rights are thus expressed with sets of (dis)allowed operations on those
types (and, indirectly, on all objects which are labeled with the given type).
EXTRA
Domains and types are
equivalent
Internally, a domain is just a type, but a type that only applies to processes.
That's why domains are suffixed with _t just like object's types.
By default, a program inherits its domain for the user who started it but the standard SELinux
policies expect many important programs to run in dedicated domains. To achieve this, those
executables are labeled with a dedicated type (for example ssh is labeled with ssh_exec_t, and
when the program starts, it automatically switches in the ssh_t domain). This automatic domain
transition mechanism makes it possible to grant only the rights required by each program.
It is a fundamental principle of SELinux.
Chapter 14 — Security
389