In this lesson, you will learn how to create custom types and domains to strictly isolate specific processes from the rest of the OS.
Building on our foundation of security contexts, we now move into the practical application of SELinux policies: defining Domains and Types. In the SELinux architecture, we use these abstractions to implement the "Least Privilege" principle at a granular level.
The Logic of Types and Domains
Think of a Type as a label for an object (like a file or a socket), and a Domain as a label for a running process.
The security policy dictates that a process running in specific_t domain can only interact with files labeled with specific_data_t. By creating custom definitions, we ensure that even if an application is compromised, it cannot "reach out" to touch files or system resources that don't share its specifically defined security boundaries.
Defining a Custom Context
To isolate a service, you define a policy module that assigns it a unique domain. For example, if you are isolating a custom database script, you might define it like this:
type my_app_t;
domain_type(my_app_t)
type my_app_data_t;
files_type(my_app_data_t)
# Allow the process to read its own data
allow my_app_t my_app_data_t:file { read open getattr };
In this snippet, we have created a "sandbox." The my_app_t domain is the process's identity, and my_app_data_t is its restricted storage area. Even if the system is running as root, the SELinux policy layer will block my_app_t from accessing sensitive system files (like /etc/shadow) because there is no defined rule allowing that interaction.
Why This Matters
If you don't define custom domains, processes often default to generic domains like unconfined_t, which inherit broader permissions. By crafting custom types and domains, you close the gap between how the OS perceives a process and the actual security needs of that process. You are effectively creating a private, restricted environment that the rest of the operating system ignores by design.
Key Takeaway: By assigning processes to custom domains and files to specific types, you create a hardware-enforced "container" that limits a process's capability to only the resources explicitly defined in your security policy.