BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← Linux
Lesson 949 of 1,8199. Security Hardening and Mandatory Access ControlFree lesson

Managing Sensitivity Labels

Assign specific sensitivity levels to users to enforce strict clearance requirements.

Managing Sensitivity Labels

In this lesson, you will learn how to enforce strict clearance requirements by assigning specific sensitivity levels to users, ensuring they can only access data that matches or falls below their authorized security clearance.

In Multi-Level Security (MLS) environments, SELinux goes beyond standard Type Enforcement. While types define what an object is, sensitivity labels define how high the security barrier is. A sensitivity label consists of a hierarchical level (e.g., s0 for public, s1 for secret, s2 for top-secret) and optional categories.

Assigning Clearance to Users

To control what a user can see or modify, we map their Linux user account to an SELinux user identity that includes a range of sensitivity levels. This is handled via semanage login. For example, if you want to assign a user to the staff_u SELinux user with a clearance range of s0 to s1, you would run:

# Map the Linux user 'jdoe' to an SELinux user with a max sensitivity of s1
sudo semanage login -a -s staff_u -r s0-s1 jdoe

The Enforcement Mechanism

When jdoe logs in, their shell process is automatically labeled with their clearance level. SELinux enforces the "Bell-LaPadula" model: no read up, no write down.

  1. Read restriction: If jdoe (cleared for s1) attempts to read a file labeled s2, the kernel denies the access because the file’s sensitivity is higher than the user's clearance.
  2. Write restriction: To prevent data leakage, a user at s1 is generally forbidden from writing to an s0 object (preventing "writing down" secret information into a public area).

By mapping users to specific ranges, you create a rigid hierarchy where sensitive data is physically inaccessible to users without the appropriate "security clearance" label, even if their user type would otherwise permit the action. You can verify a user's current sensitivity range using seinfo -u staff_u or by inspecting the mapping in /etc/selinux/targeted/seusers.

Key Takeaway: Sensitivity labels allow you to impose a hierarchical clearance system where process access is strictly gated by the user's assigned sensitivity range, effectively preventing unauthorized access to high-clearance data.