Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 763 / 848

Assigning Categories to Files
737
Note
MCS category access is assigned during login. Consequently, a user does not have
access to newly-assigned categories until they log in again. Similarly, if access to a
category is revoked, this is only apparent to the user after the next login.
44.5.5. Assigning Categories to Files
At this point we have a system that has several user accounts, each of which is mapped to an
SELinux user identity. We have also established a number of categories that are suitable for the
particular deployment, and assigned those categories to different users.
All of the files on the system, however, still fall under the same category, and are therefore accessible
by everyone (but still according to the standard Linux DAC and TE constraints). We now need to
assign categories to the various files on the system so that only the appropriate users can access
them.
For this example, we create a file in Daniel's home directory:
[daniel@dhcp-133 ~]$ echo "Financial Records 2006" > financeRecords.txt
Use the
ls -Z
command to check the initial security context of the file:
[daniel@dhcp-133 ~]$ ls -Z financeRecords.txt
-rw-r--r-- daniel daniel user_u:object_r:user_home_t financeRecords.txt
Notice that at this stage the file has the default context for a file created in the user's home directory
(
user_home_t
) and has no categories assigned to it. We can add the required category using the
chcat
command. Now when you check the security context of the file, you can see the category has
been applied.
[daniel@dhcp-133 ~]$ chcat -- +Finance financeRecords.txt
[daniel@dhcp-133 ~]$ ls -Z financeRecords.txt
-rw-r--r-- daniel daniel root:object_r:user_home_t:Finance financeRecords.txt
In many cases, you need to assign more than one category to a file. For example, some files may
need to be accessible to users from both the Finance and Payroll departments.
[daniel@dhcp-133 ~]$ chcat -- +Payroll financeRecords.txt
[daniel@dhcp-133 ~]$ ls -Z financeRecords.txt
-rw-r--r-- daniel daniel root:object_r:user_home_t:Finance,Payroll financeRecords.txt
Each of the categories that have been assigned to the file are displayed in the security context. You
can add and delete categories to files as required. Only users assigned to those categories can
access that file, assuming that Linux DAC and TE permissions would already allow the access.
If a user who is assigned to a different category tries to access the file, they receive an error message: