TracNav menu
SELinux Object Classes and Permissions Reference
This document contains a list of all of the object classes and permissions for SELinux including a brief description of of the semantics of each permission. Additionally, any permissions that are version-specific are noted. The permission descriptions are only a rough initial version and might be incomplete or inaccurate. Please send any updates or suggestions for changes to these descriptions, or any other part of this document, to selinux@tresys.com
| Permission | Description |
| getattr | Get file attributes for block file, such as access mode. (e.g. stat, some ioctls. ...) |
| relabelto | Change the security context based on the new type. |
| unlink | Remove hard link (delete). |
| ioctl | IO control system call requests not addressed by other permissions. |
| execute | Execute. |
| append | Append file contents. i.e opened with O_APPEND flag. |
| read | Read block file contents. |
| setattr | Change file attributes for block file such as access mode. (e.g. chmod, some ioctls, ...) |
| swapon | Allows file to be used for paging/swapping space. |
| write | Write or append file contents. |
| lock | Set and unset block file locks. |
| create | Create new block file. |
| rename | Rename a hard link. |
| mounton | Use as mount point; only useful for directories in Linux. |
| quotaon | Enabling quotas. |
| relabelfrom | Change the security context based on existing type. |
| link | Create hard link to block files |
common socket (22 Permissions)
| Permission | Description |
| append | Write or append socket file contents. |
| relabelfrom | Change the security context based on existing type. |
| create | Create new socket file. |
| read | Read socket file contents. |
| sendto | Send datagrams to socket. |
| connect | Initiate connection. |
| recvfrom | Receive datagrams from socket. |
| send_msg | Send datagram message; implicitly granted if the message SID is equal to the sending socket SID. |
| bind | Bind name. |
| lock | Set and unset socket file locks |
| ioctl | IO control system call requests not addressed by other permissions. |
| getattr | Get file attributes for socket file, such as access mode. (e.g. stat, some ioctls. ...) |
| write | Write or append socket file contents. |
| setopt | Set socket options. |
| getopt | Get socket options. |
| listen | Listen for connections. |
| setattr | Change file attributes for file such as access mode. (e.g. chmod, some ioctls, …) |
| shutdown | Shutdown connection. |
| relabelto | Change the security context based on the new type. |
| recv_msg | Receive datagram message; implicitly granted if the message SID is equal to the sending socket SID. |
| accept | Accept a connection. |
| name_bind | Use port or file; for AF_INET sockets, controls relationship between a socket and it's port number; for AF_UNIX sockets, controls relationship between a socket and it's file |
| Permission | Description |
| write | Write or append. |
| destroy | Destroy. |
| unix_write | Write or append; required by IPC operations. |
| getattr | Get file attributes, such as access mode. (e.g. stat, some ioctls. ...) |
| create | Create. |
| read | Read. |
| setattr | Change file attributes for shared memory segment such as access mode. (e.g. chmod, some ioctls, ...) |
| unix_read | Read; required by IPC operations. |
| associate | Associate a key |
file (17 Inherited Permissions, 3 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
| Unique Permissions | |
| execute_no_trans | Execute in the caller's domain. |
| entrypoint | Can be executed as the entry point of the new domain in a transition. |
| execmod (v.18+ | Make executable a file mapping that has been modified by copy-on-write. |
blk_file (17 Inherited Permissions, 0 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
chr_file (17 Inherited Permissions, 3 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
| Unique Permissions | |
| execute_no_trans | Execute in the caller's domain. |
| entrypoint | Can be executed as the entry point of the new domain in a transition. |
| execmod (v.18+) | Make executable a file mapping that has been modified by copy-on-write. |
fifo_file (17 Inherited Permissions, 0 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
lnk_file (17 Inherited Permissions, 0 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
sock_file (17 Inherited Permissions, 0 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
dir (17 Inherited Permissions, 5 Unique Permissions)
Inherits from: common file
| Permission | Description |
| Common Permissions | |
| getattr | see common file:getattr |
| relabelto | see common file:relabelto |
| unlink | see common file:unlink |
| ioctl | see common file:ioctl |
| execute | see common file:execute |
| append | see common file:append |
| read | see common file:read |
| setattr | see common file:setattr |
| swapon | see common file:swapon |
| write | see common file:write |
| lock | see common file:lock |
| create | see common file:create |
| rename | see common file:rename |
| mounton | see common file:mounton |
| quotaon | see common file:quotaon |
| relabelfrom | see common file:relabelfrom |
| link | see common file:link |
| Unique Permissions | |
| search | Search. |
| rmdir | Remove. |
| getattr | Get file attributes for file, such as access mode. (e.g. stat, some ioctls. ...) |
| remove_name | Remove a file from the directory. |
| reparent | Change parent directory. |
| add_name | Add a file to the directory. |
socket (22 Inherited Permissions, 0 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
key_socket (22 Inherited Permissions, 0 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
netlink_socket (22 Inherited Permissions, 0 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
packet_socket (22 Inherited Permissions, 0 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
rawip_socket (22 Inherited Permissions, 1 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
| Unique Permissions | |
| node_bind (v.17+) | Ability to bind to a node. |
tcp_socket (22 Inherited Permissions, 5 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
| Unique Permissions | |
| connectto | Connect to server socket. |
| newconn | Create new socket for connection. |
| acceptfrom | Accept connection from client socket. |
| node_bind (v.17+) | Ability to bind to a node. |
| name_connect (v.19+) | Connect to a specific port number. |
udp_socket (22 Inherited Permissions, 1 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
| create | see common socket:create |
| read | see common socket:read |
| sendto | see common socket:sendto |
| connect | see common socket:connect |
| recvfrom | see common socket:recvfrom |
| send_msg | see common socket:send_msg |
| bind | see common socket:bind |
| lock | see common socket:lock |
| ioctl | see common socket:ioctl |
| getattr | see common socket:getattr |
| write | see common socket:write |
| setopt | see common socket:setopt |
| getopt | see common socket:getopt |
| listen | see common socket:listen |
| setattr | see common socket:setattr |
| shutdown | see common socket:shutdown |
| relabelto | see common socket:relabelto |
| recv_msg | see common socket:recv_msg |
| accept | see common socket:accept |
| name_bind | see common socket:name_bind |
| Unique Permissions | |
| node_bind (v.17+) | Ability to bind to a node. |
unix_dgram_socket (22 Inherited Permissions, 0 Unique Permissions)
Inherits from: common socket
| Permission | Description |
| Common Permissions | |
| append | see common socket:append |
| relabelfrom | see common socket:relabelfrom |
