In this lesson, you will learn how to identify the structure and purpose of security contexts, which serve as the "labels" that allow Mandatory Access Control (MAC) systems to govern every interaction on your Linux system.
What is a Security Context?
In a standard Linux environment, permissions are based on Discretionary Access Control (DAC)—basically, who owns the file and what the traditional read/write/execute bits allow. A security context goes a step further by adding an extra layer of metadata to files, processes, and sockets.
Think of a security context as a digital "ID badge" for every object in the system. While DAC asks, "Does this user own the file?", MAC asks, "Is this process, possessing this specific context, authorized to interact with an object that has that specific context?"
Anatomy of a Context
If you are using SELinux, you can see these contexts by running ls -Z. The output will look something like this:
unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html
The standard structure consists of four main parts:
- User (
unconfined_u): The SELinux user identity. - Role (
object_r): Defines the role for the subject or object. - Type (
httpd_sys_content_t): The most critical part for most administrators. It defines the "type" of the file (e.g., is this a web page, a configuration file, or a log?). - Level (
s0): Used for Multi-Level Security (MLS) to define sensitivity categories.
The Purpose of Contexts
The primary purpose of these labels is to enforce the principle of least privilege. Even if a process is running as root (which usually has god-like powers in DAC), it is still bound by its security context. If the process has the context httpd_t and the file it tries to access is labeled ssh_key_t, the MAC policy will block the access because the "web server" context does not have the authority to interact with "SSH keys."
By decoupling access from user IDs and binding it to these granular, system-wide labels, we prevent a compromised service from traversing the file system or executing unauthorized actions, regardless of the user account running the process.
Key Takeaway: Security contexts are granular labels assigned to files and processes that provide the foundation for Mandatory Access Control, ensuring that operations are permitted based on policy-defined roles and types rather than just user-based permissions.