You have two applications installed which bring their own labels and rules, lets say app_a_t and app_b_t.
Now you want to give AppA read access to only one specific directory of AppB data (which is labeled app_b_t).
How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for app_b_t.
My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).
In some usecases SELinux is less flexible:
You have two applications installed which bring their own labels and rules, lets say
app_a_tandapp_b_t. Now you want to give AppA read access to only one specific directory of AppB data (which is labeledapp_b_t).How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for
app_b_t.My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).