Mapping HTTP users to contexts

Applications generally run with a static context, which inhibits all privileges that are needed for the application. Even services (daemons) generally stay within their own context during the entire life cycle of the service. But, with mod_selinux, it is possible to transition the context of the web server handler (the process or thread responsible for handling a specific request) to another context based on the authenticated user. This allows the administrator to grant certain privileges to the application based on the user. When a lower-privileged user abuses a vulnerability in the web application, then the reduced privileges on the web application itself might prevent a successful exploit.

How to do it…

Through the following set of steps, we will map a web user to a specific SELinux context:

1. Create a mapping file in which the users are listed together with their target context. For instance, to have user John's requests handled with the sensitivity s0:c0,c2...