SELinux and Active Policy

Latest response

Got a question involving SELinux and the active policy.

Based on my understanding:
- the active policy can be either MLS or Targeted.
- only a single policy can be active at one time

The active policy can be queried using the "sestatus" command,
so here's what the output looks like on my RHEL 9.2 system:

SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Whoa!!!! Stop the presses!!!
Loaded policy name: targeted
and
Policy MLS status: enabled

Ah, does this mean that both the Targeted and MLS policies
are active??????

Just to make sure that my system wasn't deceiving me,
I took a peek at the /sys/fs/selinux/mls file, and I did see
that it contained a value of "1"

I know for sure that MLS is in the picture, because when I
look at the label for a process or file, I'm seeing that 4th
field (sensitivity info) - that 4th field that ONLY applies
to MLS policy.

Okay, what am I missing? Where's the hole in my
understanding?

I love SELinux :-)

Responses