In this lesson, you will learn how to define explicit, granular rules that dictate when a process is permitted to shed its current security domain and adopt a more restricted or specialized one.
The Mechanism of Domain Transitions
In SELinux, a process starts in a specific security context. When it executes a new binary, it often remains in that same domain. However, for security hardening, we often want a process to "transition" to a different, more restrictive domain upon executing specific files. This is known as a Type Enforcement (TE) transition.
A transition rule essentially tells the kernel: "When a process with source_t executes a file labeled file_t, the resulting process must run with target_t."
Defining the Rule
To implement this, we use the type_transition rule. This does not grant permission to execute; it merely specifies the destination label once the execution occurs. You still need explicit allow rules to grant the execute and transition permissions.
Consider a web server process (httpd_t) that needs to run a specialized script (cgi_t):
# 1. Define the transition rule
type_transition httpd_t cgi_script_exec_t : process cgi_t;
# 2. Grant permission to execute the file
allow httpd_t cgi_script_exec_t : file { execute };
# 3. Grant the process permission to transition to the new domain
allow httpd_t cgi_t : process { transition };
Why This Matters for Security
By forcing a transition, you ensure that even if the web server is compromised, the attacker cannot execute arbitrary code with the web server’s elevated privileges. Instead, they are trapped within the cgi_t domain, which is restricted by its own specific policy, preventing access to sensitive files or networking capabilities that the httpd_t domain might have possessed.
Without these explicit transition rules, processes would frequently inherit the context of their parents, leading to "privilege creep" where a child process is just as dangerous as its parent. Defining these boundaries is the primary way we enforce the Principle of Least Privilege in complex service architectures.
Key Takeaway: Advanced transition rules define the exact security domain a process must enter upon execution, acting as a critical firewall against privilege escalation within a system.