In this lesson, you will learn how to restrict user access by assigning them to specific roles that dictate which execution domains they are authorized to enter.
Beyond Discretionary Access
While standard Linux permissions (DAC) focus on who owns a file, Role-Based Access Control (RBAC) in SELinux focuses on what a user is allowed to do based on their security identity. In a hardened environment, we don't just care about the file permissions; we care about the "role" the user assumes. If a user is assigned a specific role, they are confined to a subset of domains, preventing them from escalating privileges or jumping into unauthorized service domains.
Roles as Gatekeepers
An SELinux role acts as a gatekeeper between a user identity and the domains (execution environments) they are permitted to run. For example, a sysadm_r role might have permission to transition into administrative domains, while a staff_r role is restricted to standard user tasks. Even if a staff_r user gains access to a binary that would normally launch a restricted service, the policy will prevent the transition because that role lacks the authorization for that domain.
Implementation Logic
To implement this, we map a Linux user to an SELinux user, and then associate that SELinux user with one or more roles. The transition rule in our policy then dictates the behavior:
# Define the role and permit it to transition into a specific domain
role staff_r;
role staff_r types web_admin_t;
# Allow the user to transition into the domain if the role is active
type_transition staff_t web_admin_t : process web_admin_exec_t;
By explicitly declaring which roles can enter which domains, we create a strict boundary. If a user tries to execute a process outside of their assigned role's permitted domain list, the kernel blocks the execution regardless of the file's rwx permissions. This ensures that even if a system is partially compromised, the attacker remains trapped within the limited scope of the hijacked user's role.
Key Takeaway: Role-based restrictions act as an essential security layer that forces users into defined execution domains, preventing unauthorized processes from launching even if DAC permissions would otherwise allow it.