2 - Raspberry PI Community Projects

Figure 14.4
Automatic transitions between domains
IN PRACTICE
Finding the security context
To find the security context of a given process, you should use the Z option of
ps.
$ ps axZ | grep vstfpd
system_u:system_r:ftpd_t:s0 2094 ? Ss 0:00 /usr/sbin/vsftpd
The first field contains the identity, the role, the domain and the MCS level,
separated by colons. The MCS level (Multi-Category Security) is a parameter
that intervenes in the setup of a confidentiality protection policy, which regulates
the access to files based on their sensitivity. This feature will not be
explained in this book.
To find the current security context in a shell, you should call id -Z.
$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Finally, to find the type assigned to a file, you can use ls -Z.
$ ls -Z test /usr/bin/ssh
unconfined_u:object_r:user_home_t:s0 test
system_u:object_r:ssh_exec_t:s0 /usr/bin/ssh
It is worth noting that the identity and role assigned to a file bear no special
importance (they are never used), but for the sake of uniformity, all objects
get assigned a complete security context.
14.4.2. Seing Up SELinux
SELinux support is built into the standard kernels provided by Debian. The core Unix tools
support SELinux without any modifications. It is thus relatively easy to enable SELinux.
390 The Debian Administrator's Handbook