49.7.4. Object Classes and Permissions
SELinux defines a number of classes for objects, making it easier to group certain permissions by specific classes. For example:
- File-related classes include
filesystemfor file systems,filefor files, anddirfor directories. Each class has its own associated set of permissions.Thefilesystemclass can mount, unmount, get attributes, set quotas, relabel, and so forth. Thefileclass has common file permissions such as read, write, get and set attributes, lock, relabel, link, rename, append, etc. - Network related classes include
tcp_socketfor TCP sockets,netiffor network interfaces, andnodefor network nodes.Thenetifclass, for example, can send and receive on TCP, UDP and raw sockets (tcp_recv,tcp_send,udp_send,udp_recv,rawip_recv, andrawip_send.)
The object classes have matching declarations in the kernel, meaning that it is not trivial to add or change object class details. The same is true for permissions. Development work is ongoing to make it possible to dynamically register and unregister classes and permissions.
Permissions are the actions that a subject can perform on an object, if the policy allows it. These permissions are the access requests that SELinux actively allows or denies.
