Summary
Linux administrators can use SELinux controls to prevent or confine access to applications, but this is not always the requirement at hand. Being able to run the application with the right set of permissions is, and what the right set is depends on the user's intentions and the environment.
Within this chapter, we've learned how to apply the appropriate confinement to application domains, ranging from very isolated container environments over regular application domains, category-wide permission sets, and up to unconfined domains and even permissive domains. We learned that this is done by first finding the appropriate domain, understanding which labels the domain uses, and then assigning the right labels to the files so that the application is executed in the right domain.
We also learned how to generate new policies (using sepolicy generate) ourselves without immediately having to dive into a full SELinux policy development approach, which is what we will...
