From Fedora Project Wiki
< SELinux
MLS Roles
user_r
Standard user role. The role is not allowed to run su or sudo. Should not be able to run sensitive applications or read sensitive data.
staff_r
This is role is virtually equivalent to user_r except that it can run su/sudo and users can transition from staff_t to more priveledged domains.
sysadm_r
This role should be allowed to run all administrative applications except for the audit applications and SELinux tools that can change the running policy.
secadm_r
This role is only allowed to run the SELinux tools and change the way that SELinux is enforcing rules.
auditadm_r
This role should only be able to change the auditing subsystem.
Security Applications
- avcstat - All 3 can use.
- audit2allow - all 3 can use. Except that sysadm_r can only read /var/log/messages. secadm_r and auditadm_r can read both if running at SystemHigh
- audit2why - This should only work for secadm since it requires the reading of the policy file. He must be running at SystemHigh to process audit.log
- chcat/chcon - all 3 can use, although only certain contexts should be changeable.
- sysadm_r should be able to change everything but SELinux files and audit files
- secadm_r should be able to change all files except audit files
- auditadm should only be able to change audit files
- checkmodule - all 3 can execute. This is a tool to build a policy package, so it should not be included. Really just a compiler
- checkpolicy - only secadm_r can execute, output of this tool is a policy file.
- fixfiles - This is a script that all three can execute, but will only be able to. Should all three roles be able to transition to restorecon and setfiles?
- genhomedircon -Only secadm_r should be able to succeffully run this, audit messages will be generated and it will die a horrible death.
- getsebool - all 3 can use.
- getenforce - all 3 can use.
- load_policy - only secadm_r can execute
- matchpathcon - all 3 can use.
- restorecon - only sysadm and secadm can use, auditadm can not use
- run_init - only sysadm can use
- currently getting execvp defined message after authentication
- selinuxenabled - all 3 can use.
- semanage - all 3 can execute
- sysadm_r Should be able to use in readonly mode
- secadm_r - Full functionaility
- auditadm_r - Should not be allowed to run, or read only mode
- semodule - only secadm_r can execute.
- semodule_expand - all 3 can execute.
- semodule_link - all 3 can execute.
- semodule_package - all 3 can execute.
- sestatus - all 3 can execute.
- setenforce - Only secadm_r can setenforce 0
- setfiles - only secadm_r can execute.
- setsebool - only secadm_r can actually set anything
- system-config-securitylevel - Only secadm_r can change anything, everyone else is read only.
- Tools from TreySys
- These tools are all governed by who can read the policy files or auditlogs.
- apol - all 3 can execute, requires GUI which I don't have installed.
- seaudit - all 3 can execute, requires GUI which I don't have installed.
- seaudit_report - all 3 can execute
- sechecker - all 3 can execute
- seinfo - all 3 can execute
- sesearch - all 3 can execute.