6.10. Allowing MLS users to edit files on lower levels

Procedure

1. Optional: Switch to permissive mode for easier troubleshooting.

   # setenforce 0

2. Open a new .cil file with a text editor, for example ~/local_mlsfilewrite.cil, and insert the following custom rule:

   (typeattributeset mlsfilewrite (_staff_t_))

   You can replace staff_t with a different SELinux type. By specifying SELinux type here, you can control which SELinux roles can edit lower-level files.

   To keep your local modules better organized, use the local_ prefix in the names of local SELinux policy modules.

3. Install the policy module:

   # semodule -i ~/local_mlsfilewrite.cil

   注意

   To remove the local policy module, use semodule -r ~/local_mlsfilewrite. Note that you must refer to the module name without the .cil suffix.

4. Optional: If you previously switched back to permissive mode, return to enforcing mode:

   # setenforce 1

Verification

1. Find the local module in the list of installed SELinux modules:

   # semodule -lfull | grep "local_mls"
   400 local_mlsfilewrite  cil

   Because local modules have priority 400, you can list them also by using the semodule -lfull | grep -v ^100 command.

2. Log in as a user assigned to the type defined in the custom rule, for example, staff_t.

3. Attempt to write to a file with a lower sensitivity level. This increases the file’s classification level to the user’s clearance level.

   重要

   The files you use for verification should not contain any sensitive information in case the configuration is incorrect and the user actually can access the files without authorization.