How does SELinux assign context?

SELinux (Security-Enhanced Linux) assigns security contexts to processes and files to enforce access control policies. Here's how it works:

1. Security Context: Each process and file is labeled with a security context, which includes a user, role, type, and level. The most critical part is the type, which determines the permissions.

2. Labeling: When a file is created or a process starts, SELinux assigns a default security context based on the policy rules. This can be done automatically or manually using tools like chcon for files or semanage for managing contexts.

3. Policy Enforcement: SELinux uses a set of policies that define what actions are allowed based on the security contexts. When a process tries to access a file, SELinux checks the contexts against the policy rules to determine if the action is permitted.

4. Context Types: Common context types include user_u, system_u, and object_r, which help in defining the roles and permissions for users and objects.

Example

To view the security context of a file, you can use:

ls -Z /path/to/file

To change the context of a file, you can use:

chcon -t httpd_sys_content_t /var/www/html/index.html

For more in-depth learning, consider exploring SELinux documentation or relevant security labs.