Security in depth · Unit 22 · Lesson 15 of 44

Mandatory policy adds another boundary

Check whether mandatory policy actually constrains the process in your record.

3 minreadyShort lesson

Helpful before thisLinux privilege escalation

See all lessons in this topic

After this lesson you can

Distinguish a recorded policy denial from an operation blocked by enforcement.

An audit message can describe a decision that was never enforced.

Policy, coverage, and mode

SELinux adds policy decisions based on security labels. AppArmor uses a different profile model. Both can constrain applications beyond ordinary file permissions, but installing the framework does not prove that a particular process is confined.

For SELinux, check the system mode and the process domain. A domain can be permissive even when the system is enforcing. Permissive policy records relevant denials without applying those denials to block operations. Ordinary permissions and other controls still matter.

These are contributing access checks, not a complete list. Mandatory policy changes the result only where the relevant restriction is enforced.

Supplied record: the village archive

This fictional archive approves its web service to read public pages, never private donor notes. The review contains:

System mode: enforcing.
Archive process: domain archive_web_t, marked permissive.
Ordinary permissions: allow reading the sample donor note.
Audit entry: policy would deny that read.
Application evidence: the supplied synthetic note was read successfully.

Assume the records describe the same process, operation, and time. No other control blocks this read. The audit entry therefore identifies a policy mismatch; it is not proof of prevention. The domain exception explains the difference.

Define the intended result

Record an owned proposal to review the domain exception and validate the necessary policy before enforcing it. Simply removing a restriction could conceal the mismatch, while a careless change could interrupt public pages.

Your acceptance note should require the approved public read to succeed and the private read to be denied under the intended policy. Include the relevant domain, effective mode, and policy version. One successful denial does not establish coverage for every archive process.

Check yourself

No timer. No penalties. Read the explanation and try again whenever you like.

What does the archive record establish about the private-note read?

Show the answer
Correct answer: The policy would deny it, but this permissive domain did not enforce that denial. A domain can remain permissive while the system is enforcing. The supplied successful read and permissive-domain setting agree.

Try it

WriteWrite a review note for the archive service naming the missing enforcement, the approved behavior, and two acceptance cases: public-page reading allowed and private-note reading denied.

References