How to create a custom SELinux label Just for my own app?

How to create a custom SELinux label Just for my own app?

WARNING: ‘var_t’ is a base type. allow init_t var_t:file rename; I googled around and I found out I should use a more specific SELinux label than a base type, but all the examples online show you existing labels from httpd/nginx/etc. Is there a way I can create a custom label just for my own app?

How to create a new SELinux file context?

To create a new SELinux file contextto apply to a parent directory that holds files your program/daemon will modify, you edit the app.te file and add : type app_var_t; files_type(app_var_t)

How to create your own policy in SELinux?

In the above example, the role of the policy we had is to enhance the rights of the user_t domain. Hence, we can assume the user_t domain is indeed a good type to directly use (otherwise you’d need to update the unprivuser.te policy, which is governed by Gentoo’s policy).

How does SELinux store information in extended attributes?

SELinux too stores its information in an extended attribute. These extended attributes are always for one file only: files cannot “share” extended attributes, but multiple files can of course have the same values for their extended attributes.

What does the context label mean in SELinux?

On systems running SELinux, all processes and files are labeled in a way that represents security-relevant information. If you try create a container with data stored in a directory other than /var/lib/containers you will get permission denied. I’ll demonstrate this on a CentOS 8 server.

How are Apache log labels stored in SELinux?

In this rule, apache_process and apache_log are labels. An SELinux security policy assigns labels to processes and defines relations to system resources. This way, a policy maps operating-system entities to the SELinux layer. SELinux labels are stored as extended attributes of file systems, such as ext2.