In this lesson, you will learn how Mandatory Access Control (MAC) systems like SELinux or AppArmor determine the security context of child processes when an application spawns new tasks.
The Mechanics of Inheritance
When a process initiates a fork() or exec() call, the default behavior in a MAC-enforced environment is for the child process to inherit the security context of its parent. While this provides consistency, complex application trees—such as a web server spawning a CGI script or a database engine triggering a maintenance utility—often require the child to run under a more restrictive, specialized label.
If a parent process runs with a broad administrative context, any child it spawns implicitly inherits those same permissions. This is a common security vulnerability; if the parent is compromised, the child inherits the "keys to the kingdom."
Managing Transitions
To handle inheritance nuances, we use Domain Transitions. Instead of allowing a child to simply adopt the parent’s label, we define policy rules that force the child into a specific "target" domain regardless of who spawned it.
For example, in SELinux, a type_transition rule instructs the kernel to switch the security context during the execve() system call:
# Define a transition from the web_t domain to the cgi_script_t domain
type_transition httpd_t cgi_exec_t : process cgi_script_t;
In this snippet, when a process in the httpd_t domain executes a file labeled cgi_exec_t, the kernel automatically transitions the new process to the cgi_script_t domain. This ensures the child process starts with only the permissions necessary for its specific task, rather than the expansive permissions of the web server.
Strategic Considerations
When designing your policy tree, always aim for Principle of Least Privilege inheritance. Before allowing a process to spawn a child, ask: "Does this child truly need the parent's context, or should it be isolated in a confined domain?" By explicitly defining transition paths, you prevent privilege creep throughout your application’s process tree. If you fail to define these transitions, the kernel defaults to the inherited label, which is almost always less secure than a tailored, granular profile.
Key Takeaway: Control security context inheritance by implementing explicit domain transitions, ensuring that child processes are confined to their own restricted labels rather than automatically assuming the parent's authority.