SELinux and Active Policy
Got a question involving SELinux and the active policy.
Based on my understanding:
- the active policy can be either MLS or Targeted.
- only a single policy can be active at one time
The active policy can be queried using the "sestatus" command,
so here's what the output looks like on my RHEL 9.2 system:
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
Whoa!!!! Stop the presses!!!
Loaded policy name: targeted
and
Policy MLS status: enabled
Ah, does this mean that both the Targeted and MLS policies
are active??????
Just to make sure that my system wasn't deceiving me,
I took a peek at the /sys/fs/selinux/mls file, and I did see
that it contained a value of "1"
I know for sure that MLS is in the picture, because when I
look at the label for a process or file, I'm seeing that 4th
field (sensitivity info) - that 4th field that ONLY applies
to MLS policy.
Okay, what am I missing? Where's the hole in my
understanding?
I love SELinux :-)