SELinux
SELinux is a mandatory access control system which enables a more fine-grained access control mechanism as well as allow the security administrator to define what a user can do and can't. Unlike the standard discretionary access control in place for Linux (which means that the end user can still share files he shouldn't share, allow others to have write access to his files, etc.) a mandatory access control system is fully governed through a security policy.
With SELinux, which works alongside the standard discretionary access control system (the DAC system is first checked and only when this would allow an activity, then SELinux is queried as well), processes run inside what it calls a domain. Privileges are then assigned to a domain to define the allowed interactions with other resources (be it processes, other domains, files, sockets, capabilities, file contexts, semaphores, messages, ...).
Gentoo Support
In the Gentoo Project, SELinux is supported through the Gentoo Hardened project although it does not require the use of the hardened profiles (you can enable SELinux without using the hardened toolchain).
SELinux Policy Modules
SELinux uses a modular approach on its policies. Core permissions are contained within the "base" policy whereas additional privileges are defined in SELinux modules. You can list the currently loaded SELinux modules through semodule -l. As a policy module contains definitions (what domains are provided by the module, which resources are labeled and how are they labeled), privileges (what interactions are allowed), optional privileges (which are triggered through SELinux booleans) and more, it is sometimes warranted to have a more elaborate document on the specifics of that module.
Below you'll find a list of documented modules.
- apache is the SELinux module to support web servers like apache or lighttpd
- bind is the SELinux module to support the named domain server
- cron is the SELinux module for the various cron domains (like vixie-cron)
- ldap is the SELinux module for OpenLDAP
- portage is the SELinux module offering support for Gentoo's portage and portage-related tools (like gcc-config, eselect, ...)
