A quick introduction to SELinux helps to have a high-level idea behind the SELinux security subsystem. It covers the difference between discretionary and mandatory access control, the labeled approach that SELinux takes and how it is integrated in the Linux operating system.
For more in-depth information, please refer to the following resources.
| Concepts | |
|---|---|
| Type enforcement | Controlling accesses is done in most cases through a type-enforcement based approach |
| Role-based access control | Ensuring a least privilege approach on a Linux system using SELinux' RBAC model |
| User-based access control | Ensuring segregation of users, even when they run using the same domains and accessing the same types |
| Information flow control | Limiting information flow based on security clearance and sensitivities |
| Unconfined domains | When SELinux protections are not needed in all cases, unconfined domains can be used. |
| User guides | |
| Installation | The main resource for installing and enabling SELinux on a Gentoo system |
| Users and logins | Mapping Linux users (logins) to SELinux users |
| Managing labels | Setting and configuring file (and other resource) labels |
| Policy | The SELinux policy defines the acceptable behavior on a system; it can be rebuilt by administrators, loaded and unloaded (through its modular design) and tweaked by adding more policy rules |
| Logging | SELinux usually logs denials in the audit log (or system log if no auditing is enabled) |
| Booleans | Enable or disable additional policy controls through SELinux booleans |
| States | SELinux can be enabled or disabled, and running in enforcing, partial permissive or full permissive mode |
| Expert documentation | |
| Policy development | Updating SELinux policy to suit your needs, and send patches to Gentoo or even upstream projects |
| Policy store | The policy store contains the SELinux policy binaries; multiple stores can be defined on a system |
| Networking support | SELinux supports port labeling, but also packet-based access controls through SECMARK and peer-to-peer labeling support |
| Reference material | |
| FAQ | Frequently Asked Questions on SELinux and SELinux integration in Gentoo |
| SELinux policy language | Supported SELinux language constructs |
| Policy module specific information | More in-depth information about particular SELinux policy modules |