LX0-104 · Question #392
What is the difference between an SELinux domain and an SELinux type?
The correct answer is C. A domain is assigned to processes while a type is assigned to objects such as files and directories. In SELinux, a domain specifically refers to the type assigned to a process, while 'type' is a more general term used to label any object, including files, directories, and processes.
Question
Options
- AA domain is a group of SELinux types.
- BA domain defines the range of access that an object has. A type is used to define an access level.
- CA domain is assigned to processes while a type is assigned to objects such as files and directories.
- DA domain is an alternative keyword for type.
How the community answered
(49 responses)- A2% (1)
- C94% (46)
- D4% (2)
Why each option
In SELinux, a domain specifically refers to the type assigned to a process, while 'type' is a more general term used to label any object, including files, directories, and processes.
A domain is a type for a process, not a group of types.
Both domains (process types) and types (object labels) define access ranges based on policy rules, but the distinction is in what they label (processes vs. general objects).
In SELinux, a 'type' is a label assigned to any object (files, directories, ports, devices, etc.) and also to processes. When a type is assigned to a process, it is specifically referred to as a 'domain.' Therefore, a domain is essentially a type for a process, defining its security context and what it can access.
While closely related, 'domain' is a specific application of 'type' for processes, not merely an alternative keyword.
Concept tested: SELinux domain vs. type
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-selinux_users_and_administrators_guide-working_with_selinux-selinux_concepts
Topics
Community Discussion
No community discussion yet for this question.