5 Extending SELinux Policies with Multi-Category Security

Multi-Category Security (MCS) extends the SELinux targeted and Multi-Level Security (MLS) policies so you can assign category labels to processes and files. With MCS, files can be accessed only by processes or users that are assigned to the same categories that apply to the file. MCS is applied after all other security checks have been performed. Thus MCS is typically used to further restrict access. Category tags range from c0 to c1023, but you can define text labels for these category values to make them easier to work with. The mcstrans service can be used to translate between the category values and text labels when handling system inputs and outputs.

While MLS can be used to define different security levels or sensitivity for data, MCS can be used to group data for different purposes. For example, you might run the same service for several different projects on a system and data within each project that might have different levels of sensitivity. Users must only be granted access to data that meets their sensitivity clearance for a particular project. MCS enforces this restriction by associating a category tag with each project. The resulting security context of a file or process is a combination of SELinux user, SELinux role, SELinux type, MLS sensitivity level, and MCS category.

Table 5-1 Matrix to illustrate data sensitivity and category application

Sensitivity	Category
	Not specified	Accountancy	Marketing	Development
Unclassified	s0	s0:c0	s0:c1	s0:c2
Internal	s1	s1:c0	s1:c1	s1:c2
Restricted	s2	s2:c0	s2:c1	s2:c2
Highly Restricted	s3	s3:c0	s3:c1	s3:c2

In the example table, a highly privileged user in the accountancy department (c0) with a requirement to access highly restricted data (s3) might have the following security context defined:

user_u:user_r:user_t:s3:c0