The differentiation between strict and targeted is based upon the unconfined domain. Gentoo supports four policy types within SELinux: strict, targeted, mcs and mls. The active policy store is defined through the /etc/selinux/config file's SELINUXTYPE variable. A policy store contains a single policy build, together with various SELinux configuration files used by the SELinux user space (such as default contexts, user mappings and so forth). This differentiation is supported through the concept of policy stores. It is possible to maintain multiple policies on the system. Support flexible inheritance of type for newly created objects Support flexible inheritance of user and role for newly created objects Role transition support for non-process classes The table below gives the current list of binary versions and their added feature.įine-grained netlink socket support added When this occurs, the binary version is increased. This binary format might change as features are added. The binary representation allows for much smaller memory requirements, as well as optimized policy decisions. The SELinux policy rules are compiled in a binary format - the human readable rules are not loaded verbatim into the SELinux subsystem. These contain all the rules related to an application (or functional coherent set of applications). Next to the base policies, individual policy modules are defined. Unlike a Linux kernel, even the base policy module can be replaced - but a base policy always needs to be loaded. The base SELinux policy contains rules that cannot be loaded/unloaded, as well as the definitions for the core Linux system controls. Similar to a kernel configuration, where the entire Linux kernel can be build in a monolithic, single image, but also in a base kernel image with additional, loadable Linux kernel modules. In order to make the SELinux policy more manageable, SELinux supports multiple policy modules.

All information that SELinux needs to govern access controls is available inside the policy. This policy is then interpreted by the SELinux subsystem to verify and manage access control.Ī SELinux policy is fully enclosed. The access rules are described / defined in the policy. 2.2 Loading and unloading specific modulesĪ main advantage of having a policy is that it segregates control from definition.

Nxfilter selinux policy