The role of Roles

SELinux also provides a role-based access control (rbac,role-based access controls). The features of SELinux Rbac are built on TE Foundation. Access control in SELinux is essentially te, the type enforcement access policy. A role can restrict a process-converted type that is converted based on a role identifier in the context of a process security. In this way, a policy definition is able to create a role that is allowed to be converted into a series of domain types (assuming the TE rules allow such conversions), thus defining the constraints of the role. Again, use our example of the cipher program in Figure 2-5. Although the password program is allowed to convert from a user_t domain type to a new passwd_t domain based on the type Enforcement access policy rule, Joe's role must also be allowed to occur for that conversion. To be able to articulate, we have extended the example of the cryptography program.

We have added a role section (USER_R) that describes the security context of the process. We have also added a new rule, role statement:

type passwd_t

The role statement declares the character identifier and links the declared role and type. The previous description declares the role User_r (if it has not been declared in the policy) and links the identifier passwd_t and the role User_r. This linkage means that the passwd_t type is allowed to coexist with the role user_r in the security context. Without this role declaration, the new context joe:user_r:user_t will not be created, and the EXECVE () system call will fail even if the TE policy allows all necessary access to Joe's type (user_t).

A policy definition can define a constrained role and associate these roles with a specific user. For example, imagine that, in our strategy, we also created a role called Retricted_user_r, which is the same in all respects as user_r, except that he is not associated with the passwd_t type. Therefore, if Joe's role is restricted_user_r instead of User_r,joe, the password program will not run
Even if the TE rule allows access to the domain identity.

In the sixth chapter, "Roles and Users" discusses in detail the meaning of roles in selinux, especially how roles are created and how they are associated with users.

The role of Roles