A file that is assigned to a certain SELinux MCS (Multi Category Security) category can be read by a user who is not assigned to that category, indicating that MCS somehow does not work on my system (running CentOS7, with a minimal installation, SELinux enforcing in targeted policy ).
I recently acquired a small vServer for myself which sparked me to dive into secure system setup and dealing with SELinux for the first time. I intend to separate applications I will run on the server by running them in docker containers (with the host itself operating on CentOS7). I was happy to learn that each docker container is (by default) assigned random SELinux MCS categories on startup to provide an additional security layer for the separation. To make myself familiar with how SELinux in general and MCS specifically works, I set up a VM on one of my home machines and played around a bit. Doing that, I noticed that MCS does not work as I would expect, so either I am missing something important or there is a configuration issue somewhere.
What I did
To test MCS I followed instructions in  and . First, I made sure that SELinux is indeed running in enforcing mode and with the targeted policy using
Adhering to , I created a mcsuser_u SELinux user and CentOS users john, jane, johnjane, which I then mapped to mcsuser_u using
semanage login. I also assigned the categories to users as listed in  and ended up with:
Login Name | SELinux User | MLS/MCS Range john | mcsuser_u | s0-s0:c122 jane | mcsuser_u | s0-s0:c123 johnjane | mcsuser_u | s0-s0:c122,123
semanage login -l and
mcsuser_u | MLS/MCS Level: s0 | MLS/MCS Range: s0-s0:c0.c1023 | SELinux Roles: user_r
semanage user -l.
I made the home directory of user john world readable (
chmod 707), logged in as john and created a text file johntext. I then assigned category c122 to that file (still logged in as john). I was also able to assign category c120 to the file, even though john is not categorized as c120 himself, which should not be possible according to  (I subsequently removed c120 again).
ls -lZ johntext shows output
-rw-rw-r-- john john mcsuser_u:object_r:user_home_t:s0:c122 johntext
Following the above, I logged in as user jane, and tried to read the file johntext using the
cat command, which I was able to do.
This, to me, clearly indicates that MCS is not working as I would expect (allowing access to objects of a certain category only if the user requesting the access has the same category).
I am somewhat confused now and don't know where the mistake resides, so I am turning to you folks for advice. It's probably just a misassumption or misunderstanding on my side, but I can't figure it out right now and it doesn't make sense to me. As I see it, there are the following possibilities:
1. I have to manually activate MCS checks or use a different policy
I did not find any information on whether I have to manually activate MCS support and thus assume that it just works if I assign labels (based on ). Other source  suggest that MCS is enabled in the targeted policy on (at least) Fedora and RHEL, from which I would expect that it is not different for CentOS.
2. There is a misconfiguration on my side
I might have made some mistake in setting up the user categories with
semanage login or assigning categories to the file.
3. It's just broken
.. which would be bad
SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28
I just tested the same steps on a VM running CentOS 6.9 where everything behaves as expected. Right now, I would thus assume that there is either some bug regarding MCS in SELinux on CentOS, or some undocumented changes to the policy/configuration that would be in need of tweaking. I'm still in doubt about what sensible next steps would be to get it working as expected.