Note: The term “Debian context” is not a standard Debian-specific term. It typically refers to SELinux (Security-Enhanced Linux) security contexts—labels that define access permissions for files, directories, and processes in SELinux-enabled systems. Below is a comparison between SELinux contexts (often called “Debian context” in Debian systems) and SELinux itself:
1. Definition
- SELinux Context: A label assigned to files, directories, processes, and ports in SELinux-enabled systems. It consists of four components:
user:role:type:level (e.g., unconfined_u:object_r:httpd_sys_content_t:s0). The type component is the most critical for access control (via Type Enforcement).
- SELinux: A mandatory access control (MAC) kernel security module that enforces access policies based on these contexts. It restricts processes to only access resources explicitly allowed by the policy, even if the traditional discretionary access control (DAC) permissions (e.g.,
chmod) permit access.
2. Purpose
- SELinux Context: Acts as a metadata tag for system resources. It enables SELinux to identify and classify resources (e.g., “this file is for web server content”) to enforce policies.
- SELinux: Provides a framework for enforcing strict access control. It minimizes the attack surface by confining processes to their own “domains” (e.g., a web server process cannot access database files unless explicitly allowed).
3. Scope
- SELinux Context: Applies to individual resources (files, directories, processes, ports). Each resource has its own context label, which is checked during access requests.
- SELinux: Operates at the system-wide level. It governs all processes and resources on the system, using policies to define allowed interactions between subjects (processes) and objects (files/resources).
4. Key Components
- SELinux Context: Comprises:
- User: Maps to a Linux user (e.g.,
unconfined_u for unconfined users).
- Role: Defines the role of the user/process (e.g.,
object_r for files).
- Type: The most important for access control (e.g.,
httpd_sys_content_t for web content).
- Level (optional): Used in Multi-Level Security (MLS) for classification (e.g.,
s0 for unclassified).
- SELinux: Includes:
- Security Policies: Rules defining allowed interactions (e.g., “allow httpd_t to read httpd_sys_content_t”).
- Enforcement Modes:
Enforcing (blocks violations), Permissive (logs violations without blocking), Disabled (turns off SELinux).
- Access Vector Cache (AVC): Caches permission checks for faster processing.
5. Management
- SELinux Context: Managed using commands to view, modify, and persist labels:
- View Context:
ls -Z (shows context of files/directories).
- Temporary Change:
chcon (modifies context until next reboot/file deletion; e.g., sudo chcon httpd_sys_content_t /var/www/html/index.html).
- Permanent Change:
semanage fcontext (defines rules) + restorecon (applies rules; e.g., sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html(/.*)?" followed by sudo restorecon -Rv /var/www/html).
- SELinux: Managed via system settings, policies, and logs:
- Check Status:
getenforce (shows Enforcing, Permissive, or Disabled).
- Change Mode:
setenforce 0 (permissive) or setenforce 1 (enforcing) (temporary); edit /etc/selinux/config for permanent changes.
- Troubleshoot: Check
/var/log/audit/audit.log for “avc: denied” messages; use audit2allow to generate custom policies from denials.
6. Relationship
SELinux uses contexts to enforce its policies. The context labels are the “tags” that SELinux checks to determine whether a process can access a resource. Without contexts, SELinux would have no way to identify or classify resources for access control. In other words:
- SELinux Context is the “what” (the label applied to resources).
- SELinux is the “how” (the framework that uses these labels to enforce access rules).