In this lesson, you will learn how SELinux uses security labels to bridge the gap between abstract policy rules and concrete system actions.
The Foundation of Enforcement
While standard Linux permissions rely on User IDs (UIDs) and Group IDs (GIDs), SELinux introduces a Mandatory Access Control (MAC) layer that operates independently of those identifiers. The core mechanism here is the security label, often referred to as a "security context."
Every entity in an SELinux-enabled system—whether it is a running process (a subject) or a file, socket, or directory (an object)—is assigned a persistent label. When a subject attempts to interact with an object, the kernel security server performs a lookup: it checks its loaded policy to see if the label of the subject is authorized to perform that specific action on the label of the object.
Anatomy of a Label
A security label is typically stored in the file system's extended attributes and follows a strict user:role:type:level format. The most critical component for most administrators is the type, which defines the domain of a process or the category of a file.
Consider this example using the ls -Z command:
$ ls -Z /etc/shadow
system_u:object_r:shadow_t:s0 /etc/shadow
In this output, shadow_t is the type label. If a process running as httpd_t (a web server) attempts to read this file, the SELinux policy will see that httpd_t does not have an explicit rule allowing access to shadow_t. Consequently, the kernel blocks the action, regardless of whether the web server process is running with root privileges.
Why Labels Matter
Labels act as the "common language" for the kernel. By decoupling the policy from the identity of the user, SELinux ensures that even if a service is compromised, it remains trapped within its own labeled domain. The system does not care who is executing a task; it only cares whether the labels of the actor and the target permit the requested operation. This granular control allows for the strict enforcement of least privilege, as each object is classified according to its role and security requirements.
Key Takeaway: Security labels serve as the metadata tags that allow the kernel to enforce policy decisions by comparing the security context of a subject against the context of an object.