Chapter 2. SELinux Policy Overview

13

# assigned to a process.

This attribute is used in TE rules

# that should be applied to all domains, e.g. permitting

# init to kill all processes.

attribute domain;

# Identifies all default types assigned to packets received

# on network interfaces.

attribute netmsg_type;

Here are a few noteworthy attributes. Information about these was obtained through policy analysis

using apol, part of the

setools

package. You can read more about this in Section 6.3 Using apol for

Policy Analysis.:

httpdcontent

The purpose of this attribute is to group together the various types associated with the policy

for Apache HTTP. Because of the complexity of the

httpd

configuration, the targeted policy

includes Boolean values that allow you to grant blanket permissions for

httpd

content types.

This helps Web applications and built in scripting, such as PHP for Apache HTTP, to work with

the content. The types in this attribute are:

# This is an aliasing relationship

httpd_sys_content_t: httpd_sysadm_content_t, \

httpd_user_content_t

# These types handle different permissions sets for scripts

httpd_sys_script_ro_t

httpd_sys_script_rw_t

httpd_sys_script_ra_t

The first line in the attribute group specifies that

httpd_sys_content_t

is an alias for

httpd_sysadm_content_t

and

httpd_user_content_t

.

file_type

This attribute is for all the types that are assigned to files, allowing for easier association of all

file types to various kinds of file system needs. This attribute makes it more convenient to allow

specific domains access to all file types. The list of types associated with the

file_type

attribute

is greater than 170 types:

...

device_t

xconsole_device_t

file_t

default_t

root_t

mnt_t

home_root_t

lost_found_t

boot_t

system_map_t

boot_runtime_t

tmp_t

etc_t: hotplug_etc_t

shadow_t

ld_so_cache_t

etc_runtime_t

fonts_t

etc_aliases_t

net_conf_t: resolv_conf_t

lib_t

shlib_t

...