Jaxelson at 20:49, 13 September 2010

Jaxelson — Mon, 13 Sep 2010 20:49:12 GMT

←Older revision		Revision as of 20:49, 13 September 2010
Line 13:		Line 13:
	----		----
	<references/>		<references/>
		+
		+	[[Category:Notebook]]

RichardHaines: New page: = Role-Based Access Control (RBAC) = To further control access to TE domains SELinux makes use of role-based access control (RBAC). This feature allows SELinux users to be associated to on...

RichardHaines — Sun, 16 May 2010 13:56:09 GMT

New page: = Role-Based Access Control (RBAC) = To further control access to TE domains SELinux makes use of role-based access control (RBAC). This feature allows SELinux users to be associated to on...

New page

= Role-Based Access Control (RBAC) =
To further control access to TE domains SELinux makes use of role-based access control (RBAC). This feature allows SELinux users to be associated to one or more roles, where each role is then associated to one or more domain types as shown in the [http://taiga.selinuxproject.org/~rhaines/diagrams/4-RBAC.png Role Based Access Control] diagram. Note that GNU / Linux users are not a direct part of the RBAC feature, they are associated to SELinux users via SELinux specific commands<ref name="ftn6"><sup>There are other SELinux utilities that can manage users etc., however this Notebook will only use the core utilities.</sup></ref> such as:

* '''semanage login'''- That manages the association of GNU / Linux users (or groups of users) to SELinux users.

* '''semanage user''' - That manages the association of SELinux users to roles.

The [http://taiga.selinuxproject.org/~rhaines/diagrams/4-RBAC.png Role Based Access Control] diagram shows how the SELinux user and roles are associated within the basic loadable modules that form the simple message filter exercise described in Volume 2.

SELinux users can be equated to groups or classes of user, for example in the Reference Policy there is <tt>user_u</tt> for general users with <tt>staff_u</tt> and <tt>sysadm_u</tt> for more specialised users. There is also a <tt>system_u</tt> defined that must never be associated to a GNU / Linux user as it a special identity for system processes and objects.

----
<references/>

NB RBAC - Revision history

Jaxelson at 20:49, 13 September 2010

RichardHaines: New page: = Role-Based Access Control (RBAC) = To further control access to TE domains SELinux makes use of role-based access control (RBAC). This feature allows SELinux users to be associated to on...