RHEL 5 features SElinux installed by default. SElinux has the ability to protect every file on your system.

How is this done?

SELinux lables every file on your system with a security context. The security context is stored in the extended atrubits of the file. To view the security context for a file issue the following from a command prompt.

# ls -Z <file_name>

Replace the <file_name> with a file name. An example of the security context for resolv.conf.

Command:

# ls -Z /etc/reslov.conf

Output:

-rw-r–r– root root system_u:object_r:net_conf_t /etc/resolv.conf

The break down

Let’s focus on “system_u:object_r:net_conf_t”

On a typical setup SELinux uses 3 fields for a security context separated by colons.

user:role:type

In our example resolv.conf is a system file. We can tell this by looking at the user field of the security context. In our case system_u.

resolv.conf is an object file because it is labled as “object_r” in the role field and protected by the “net_conf_t” rule.

This is just a basic introduction into the world of SElinux, more information can be found here.