In this lesson, you will learn how SELinux policy domains enforce strict boundaries that prevent processes from accessing system files, even when standard UGO (User, Group, Other) permissions would otherwise allow it.
The Limitation of Discretionary Access
Traditional permissions (UGO) are "discretionary." This means if a file is marked world-readable, any process—including a malicious script running as your user—can read it. Even the root user is not inherently restricted by these bits. SELinux (Security-Enhanced Linux) introduces Mandatory Access Control (MAC), which ignores these traditional permissions if the security policy says "no."
What is a Policy Domain?
A policy domain acts as a sandbox for a process. Every running process is assigned a "type" (a label), and every file on your disk is also assigned a "type." The SELinux policy is a complex set of rules that explicitly defines which process types are allowed to interact with which file types.
For example, imagine a web server process labeled httpd_t. Even if a configuration file is world-readable (chmod 777), if the SELinux policy does not explicitly permit httpd_t to read that specific file type, the kernel will block the access.
Seeing it in Action
You can view the security context of your running processes using ps -Z.
ps -efZ | grep httpd
You will see output similar to:
system_u:system_r:httpd_t:s0 root 1234 1 0 10:00 ? 00:00:00 /usr/sbin/httpd
Here, httpd_t is the domain. The kernel checks this label against the file's label (seen via ls -Z) before granting access. If a process tries to break out of its domain to access a sensitive file (like /etc/shadow), the SELinux policy denies the request, logging it as a violation—regardless of whether the file permissions are set to read-write for everyone.
By isolating processes into specific domains, we ensure that even if a service is compromised, it remains trapped within its designated sandbox, unable to access the rest of the system's files.
Key Takeaway: SELinux policy domains create mandatory security boundaries that override traditional file permissions, ensuring that processes can only interact with files explicitly permitted by the system policy.