---

Stephen Smalley

---

Introduction

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible and fine-grained mandatory access control (MAC) architecture called Flask in the Linux kernel[LoscoccoFreenix2001]. SELinux can enforce an administratively-defined security policy over all processes and objects in the system, basing decisions on labels containing a variety of security-relevant information. The architecture provides flexibility by cleanly separating the policy decision-making logic from the policy enforcement logic. The policy decision-making logic is encapsulated within a single component known as the security server with a general security interface. A wide range of security models can be implemented as security servers without requiring any changes to any other component of the system. To demonstrate the architecture, SELinux provides an example security server that implements a combination of Type Enforcement (TE)[BoebertNCSC1985], Role-Based Access Control (RBAC)[FerraioloNCSC1992], and optionally Multi-Level Security (MLS). These security models provide significant flexibility through a set of policy configuration files. An example security policy configuration was developed to demonstrate how SELinux can be used to meet certain security goals and to provide a starting point for users [SmalleyNAITR2001][LoscoccoOLS2001]. This technical report describes how to configure the SELinux security policy for the example security server. Section 2 explains concepts defined by the Flask architecture that are important to configuring the policy. Section 3 describes the security model implemented by the example security server. The policy language and the example policy configuration are described in Section 4. Section 5 explains how the policy is built and applied to the system. Configuration files for security-aware applications are discussed in Section 6. Section 7 describes how to customize the policy for various purposes.

---

for more details, please visit
http://mirrorservicesites/ftp.wiretappedpub/security/operating-systems/selinux/papers/configuring-the-selinux-policy.pdf

---