The SELinux security server makes two basic kinds of decisions:

This section explains access decisions—the more frequently made and important of the two kinds of decisions—and the following section explains transition decisions.

Conceptually, each object class has an associated bitmap called an access vector, containing one bit for each action defined for the class. Figure 2-3 shows a simplified bitmap for the file class. An actual bitmap for the file class would include each of the more than one dozen actions defined for the file class, rather than merely the common actions shown in the figure.

Figure 2-3. A simplified access vector for the file class

As explained earlier in this chapter, the SELinux security server makes access decisions by considering the security context of the subject and object of the action, the security class of the object, and the action requested. When the security server has made the access decision, it returns an access vector that indicates the allowed actions. More precisely, if the security server finds one or more policy rules matching the request, it returns three related access vectors, as shown in Figure 2-4. In the figure, the server has granted the subject permission to append to the object or create the object.

Figure 2-4. A simplified access vector resulting from an access decision

The three access vectors have the following functions:

Three rules govern access to objects:

Table 2-3 summarizes the rules governing access to objects.

allow

auditallow

dontaudit