6.4. Establishing user clearance in MLS

Procedure

1. Optional: To prevent adding errors to your SELinux policy, switch to the permissive SELinux mode, which facilitates troubleshooting:

   # setenforce 0

   Note that in permissive mode, SELinux does not enforce the active policy but only logs Access Vector Cache (AVC) messages, which can be then used for troubleshooting and debugging.

2. Define a clearance range for the staff_u SELinux user. For example, this command sets the clearance range from s1 to s15 with s1 being the default clearance level:

   # semanage user -m -L s1 -r s1-s15 staff_u

3. Generate SELinux file context configuration entries for user home directories:

   # genhomedircon

4. Restore file security contexts to default:

   # restorecon -R -F -v /home/
   Relabeled /home/staff from staff_u:object_r:user_home_dir_t:s0 to staff_u:object_r:user_home_dir_t:s1
   Relabeled /home/staff/.bash_logout from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1
   Relabeled /home/staff/.bash_profile from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1
   Relabeled /home/staff/.bashrc from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1

5. Assign a clearance level to the user:

   # semanage login -m -r s1 example_user

   Where s1 is the clearance level assigned to the user.

6. Relabel the user’s home directory to the user’s clearance level:

   # chcon -R -l s1 /home/example_user

7. Optional: If you previously switched to the permissive SELinux mode, and after you verify that everything works as expected, switch back to the enforcing SELinux mode:

   # setenforce 1

Verification

1. Verify that the user is mapped to the correct SELinux user and has the correct clearance level assigned:

   # semanage login -l
   Login Name      SELinux User         MLS/MCS Range        Service
   __default__     user_u               s0-s0                *
   example_user    user_u               s1                   *
   …

2. Log in as the user within MLS.

3. Verify that the user’s security level works correctly:

   警告

   The files you use for verification should not contain any sensitive information in case the configuration is incorrect and the user actually can access the files without authorization.

   1. Verify that the user cannot read a file with a higher-level sensitivity.
   2. Verify that the user can write to a file with the same sensitivity.
   3. Verify that the user can read a file with a lower-level sensitivity.