Contents
How to create SELinux policy for Linux containers?
Red Hat Enterprise Linux 8 provides a tool for generating SELinux policies for containers using the udica package. With udica, you can create a tailored security policy for better control of how a container accesses host system resources, such as storage, devices, and network.
When to use a host mount with SELinux?
When using a host mount with SELinux, you need to pass an extra option to the end of the volume definition: The z option indicates that the bind mount content is shared among multiple containers. The Z option indicates that the bind mount content is private and unshared.
Why is my volume mount not granting permission?
Typically, permissions issues with a host volume mount are because the uid/gid inside the container does not have access to the file according to the uid/gid permissions of the file on the host. However, this specific case is different. The dot at the end of the permission string, drwxr-xr-x., indicates SELinux is configured.
How does SELinux control file and directory information?
Allow any process that runs as the root Linux user to read the slocate directory information Allow any process that runs as the root Linux user to write into the slocate directory (create files and such) Allow any process that runs as the root Linux user to enter the slocate directory (and thus search for files within)
How does the kernel enforce the SELinux policy?
The kernel enforces the use of an SELinux policy to evaluate access requests on the system. By default, SELinux denies all requests except for requests that correspond to the rules specified in the loaded policy.
When does SELinux run in enforcing mode red hat?
When SELinux is running in enforcing mode, it enforces the SELinux policy and denies access based on SELinux policy rules. In Red Hat Enterprise Linux, enforcing mode is enabled by default when the system was initially installed with SELinux.
How to check the status of the SELinux policy?
When enabled, SELinux has two modes: enforcing and permissive. Use the getenforce or sestatus commands to check the status of SELinux. The getenforce command returns Enforcing, Permissive, or Disabled . The sestatus command returns the SELinux status and the SELinux policy being used: