6.5. Changing a user’s clearance level within the defined security range in MLS

Procedure

1. Log in as the user from a secure terminal.

   Secure terminals are defined in the /etc/selinux/mls/contexts/securetty_types file. By default, the console is a secure terminal, but SSH is not.

2. Check the current user’s security context:

   $ id -Z
   user_u:user_r:user_t:s0-s2

   In this example, the user is assigned to the user_u SELinux user, user_r role, user_t type, and the MLS security range s0-s2.

3. Check the current user’s security context:

   $ id -Z
   user_u:user_r:user_t:s1-s2

4. Switch to a different security clearance range within the user’s clearance range:

   $ newrole -l s1

   You can switch to any range whose maximum is lower or equal to your assigned range. Entering a single-level range changes the lower limit of the assigned range. For example, entering newrole -l s1 as a user with a s0-s2 range is equivalent to entering newrole -l s1-s2.

Verification

1. Display the current user’s security context:

   $ id -Z
   user_u:user_r:user_t:s1-s2

2. Return to the previous shell with the original range by terminating the current shell:

   $ exit