Enabling MCS for Users
MCS is active by default in SELinux, but isn't configured for users. To configure MCS for
users, you must create a policy module that adds a rule to assign the
mcs_constrained_type
attribute to the user domain.
- Create a file that contains the rule, for
example:
echo '(typeattributeset mcs_constrained_type (user_t))' > local_mcs_user.cil
-
Load the new policy module.
sudo semodule -i local_mcs_user.cil
-
Verify that the
mcs_constrained_type
is now applied touser_t
domain.seinfo -xt user_t|grep mcs_constrained_type
You can add the mcs_constrained_type
attribute to any other SELinux
domain in the same way.