Figure 13. Allowing local file access control
1. root: create a test file:
$ echo “file created in root home” > /root/file
$ chmod 777 /root/file
$ mv /root/file /
$ ls -Z /file
sysadm_u:object_r:user_home_t:s0 /file
2. root: enable SELinux:
$ setenforce 1
$ getenforce 0
Enforcing
3. User test1: logs in and visits the file. User test1 logs in the system via ssh and checks id info:
$ id -Z
user_u:user_r:user_t:s0
User test1 visits the file using the vi command.
$ vi /file
SELinux denies access to the file, even though the file is 777.
Figure 14. The VI command log
Because there is no allowed rule such as the following
allow user_t home_root_t: file {write append}
4. root: change the type of file
$ setenforce 0
$ chcon -u user_u /file
$ setenforce 1
NXP Semiconductors
Industrial features
Open Industrial User Guide, Rev. 1.8, 05/2020
User's Guide
62 / 199