SELINUXTYPE

[korpe1]

/etc/selinux/config says:

# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

But am I right that SELINUXTYPE is just a arbitrary name for used policy? targeted and mls could be named fox and wolf, but my distro has just decided name them with general names? And if I fork e.g. minimum, I can name it e.g. korpe-minimum?

The reason why I ask is that "can take one of these three values" sounds like these would be configuration flags rather than just names of the used policy (path /etc/selinux/[name of the policy]).

[korpe1]

By the way, why you have named this SELINUXTYPE? What makes the name of used policy a type?

[bachradsusi]

I guess it's called SELINUXTYPE based on historic reasons, see "2) Reference Policy Build Options (build.conf)" in refpolicy - https://github.com/SELinuxProject/refpolicy/blob/main/README

TYPE String. Available options are standard, mls, and mcs.
For a type enforcement only system, set standard.
This optionally enables multi-level security (MLS) or
multi-category security (MCS) features. This option
controls enable_mls, and enable_mcs policy blocks.

NAME String (optional). Sets the name of the policy; the
NAME is used when installing files to e.g.,
/etc/selinux/NAME and /usr/share/selinux/NAME. If not
set, the policy type (TYPE) is used.

You are right that SELINUXTYPE is a name for used policy and can be set to whatever you use on your system, e.g. if you build refpolicy using NAME=local, it would be installed in /etc/selinux/local and use /var/selinux/local and you would set it setting SELINUXTYPE=local

Btw official communication channel should be [email protected] mailing list. You can subscribe by sending "subscribe selinux" in the body of an email to [email protected]. Archives of the mailing list are available at https://lore.kernel.org/selinux. I'm not sure why these discussions are enabled.

[korpe1]

I guess it's called SELINUXTYPE based on historic reasons, see "2) Reference Policy Build Options (build.conf)" in refpolicy - https://github.com/SELinuxProject/refpolicy/blob/main/README

TYPE String. Available options are standard, mls, and mcs.
For a type enforcement only system, set standard.
This optionally enables multi-level security (MLS) or
multi-category security (MCS) features. This option
controls enable_mls, and enable_mcs policy blocks.
NAME String (optional). Sets the name of the policy; the
NAME is used when installing files to e.g.,
/etc/selinux/NAME and /usr/share/selinux/NAME. If not
set, the policy type (TYPE) is used.

So, using a word type originally came from build options of the policy, where it can be considered as a type of certain policy.
That quote mention also NAME, is it just for policy build options or can I use SELINUXNAME in /etc/selinux/config?

[bachradsusi]

NAME is only refpolicy build option. As for the /etc/selinux/config see man selinux_config

[korpe1]

NAME is only refpolicy build option. As for the /etc/selinux/config see man selinux_config

Okay, so selinux_config file understand only these:

           SELINUX = enforcing | permissive | disabled
           SELINUXTYPE = policy_name
           REQUIRESEUSERS = 0 | 1
           AUTORELABEL = 0 | 1

Then the situation is a little confusing. The build options use SELINUXTYPE as flag to select variation of a policy source set (because many rules are suitable for multiple uses and it's useful keep them in a one repository) and SELINUXNAME to select name for result. This result is just binary policy for which SELINUXTYPE is completely irrelevant. At the same time selinux_config file uses SELINUXTYPE to refer SELINUXNAME. Do you agree? Should we change this?