Setting Mandatory Access Control (MAC) with SELinux

It is recommended that you set up some form of MAC on the Docker host, either through SELinux or AppArmor, depending on the Linux distribution. In this recipe, we'll see how to set up SELinux on a Fedora/RHEL/CentOS installed system. Let's first look at what SELinux is:

• SELinux is a labeling system
• Every process has a label
• Every file, directory, and system object has a label
• Policy rules control access between labeled processes and labeled objects
• The kernel enforces the rules

With Docker containers, we use two types of SELinux enforcement:

• Type enforcement: This is used to protect the host system from container processes. Each container process is labeled svirt_lxc_net_t, and each container file is labeled svirt_sandbox_file_t. The svirt_lxc_net_t type is allowed to manage any content labeled with svirt_sandbox_file_t. Container processes can only access/write container files.
• Multi Category Security enforcement: By setting type enforcement,...