検索

このコンテンツは選択した言語では利用できません。

Chapter 21. SELinux

download PDF
Security-Enhanced Linux, or SELinux, is a security architecture integrated into the current kernel using the linux security modules (LSM). It is a project of the United States National Security Agency (NSA) and the SELinux community. SELinux integration into Red Hat Enterprise Linux was a joint effort between the NSA and Red Hat.

21.1. Introduction to SELinux

SELinux provides a flexible mandatory access control (MAC) system built into the Linux kernel. Under standard Linux discretionary access control (DAC), an application or process running as a user (UID or SUID) has the user's permissions to objects such as files, sockets, and other processes. Running an SELinux MAC kernel protects the system from malicious or flawed applications that can damage or destroy the system. SELinux defines the access and transition rights of every user, application, process, and file on the system. SELinux then governs the interactions of these subjects and objects using a security policy that specifies how strict or lenient a given Red Hat Enterprise Linux installation should be.
For the most part, SELinux is almost completely invisible to system users. Only system administrators must worry about how strict a policy to implement for their server environment. The policy can be as strict or lenient as needed, and is very finely detailed. This detail gives the SELinux kernel complete, granular control over the entire system.
When a subject such as an application attempts to access an object such as a file, the policy enforcement server in the kernel checks an access vector cache (AVC), where subject and object permissions are cached. If a decision cannot be made based on data in the AVC, the request continues to the security server, which looks up the security context of the application and the file in a matrix. Permission is then granted or denied, with an avc: denied message detailed in /var/log/messages. Subjects and objects gain their security context from installed policy, which also provides the information to populate the security server's matrix.
In addition to running in an enforcing mode, SELinux can run in a permissive mode, where the AVC is checked and denials are logged, but SELinux does not enforce the policy.
For more information about how SELinux works, refer to Section 21.3, “ Additional Resources ”.
Red Hat logoGithubRedditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

© 2024 Red Hat, Inc.