Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 752 / 848

Chapter 44. Security and SELinux
726
44.1.5. Multi-Level Security (MLS)
Multi-Level Security
(MLS) is a specific Mandatory Access Control (MAC) security scheme. Under this
scheme, processes are called Subjects. Files, sockets and other passive operating system entities are
called Objects. For more information, refer to
Section 44.6, “Multi-Level Security (MLS)”
.
44.1.6. Multi-Category Security (MCS)
Multi-Category Security
(MCS) is an enhancement to SELinux, and allows users to label files with
categories. MCS is an adaptation of MLS and re-uses much of the MLS framework in SELinux. For
more information, refer to
Section 44.4.1, “Introduction”
44.2. Introduction to SELinux
Security-Enhanced Linux
(SELinux) is a security architecture integrated into the 2.6.x kernel using the
Linux Security Modules
(LSM). It is a project of the United States National Security Agency (NSA) and
the SELinux community. SELinux integration into Red Hat Enterprise Linux was a joint effort between
the NSA and Red Hat.
44.2.1. SELinux Overview
SELinux provides a flexible
Mandatory Access Control
(MAC) system built into the Linux kernel. Under
standard Linux
Discretionary Access Control
(DAC), an application or process running as a user (UID
or SUID) has the user's permissions to objects such as files, sockets, and other processes. Running a
MAC kernel protects the system from malicious or flawed applications that can damage or destroy the
system.
SELinux defines the access and transition rights of every user, application, process, and file on the
system. SELinux then governs the interactions of these entities using a security policy that specifies
how strict or lenient a given Red Hat Enterprise Linux installation should be.
On a day-to-day basis, system users will be largely unaware of SELinux. Only system administrators
need to consider how strict a policy to implement for their server environment. The policy can be
as strict or as lenient as needed, and is very finely detailed. This detail gives the SELinux kernel
complete, granular control over the entire system.
The SELinux Decision Making Process
When a subject, (for example, an application), attempts to access an object (for example, a file), the
policy enforcement server in the kernel checks an
access vector cache
(AVC), where subject and
object permissions are cached. If a decision cannot be made based on data in the AVC, the request
continues to the security server, which looks up the
security context
of the application and the file in a
matrix. Permission is then granted or denied, with an
avc: denied
message detailed in
/var/log/
messages
if permission is denied. The security context of subjects and objects is applied from the
installed policy, which also provides the information to populate the security server's matrix.
Refer to the following diagram: