I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.My user is confied to one category (C2), and the file is set to C3.[test1@jsightler ~]$ id -Zunconfined_u:unconfined_r:unconfined_t:s0:c2[test1@jsightler ~]$ cd /testdir/[test1@jsightler testdir]$ ls -Z-rw-r--r--. root root unconfined_u:object_r:default_t:s0:c3 test[test1@jsightler testdir]$ cat test adfasdfadsfasWhy does this read succeed?EDIT: sestatus output:[root@jsightler ~]# sestatusSELinux status:                 enabledSELinuxfs mount:                /selinuxCurrent mode:                   enforcingMode from config file:          enforcingPolicy version:                 24Policy from config file:        targeted[root@jsightler ~]#
Why does SELinux allow me to read this file?
rhel;selinux
[test1@jsightler ~]$ id -Zunconfined_u:unconfined_r:unconfined_t:s0:c2Not an expert, but that doesn't look like a confined user to me.  Where does it indicate to you that this user is confined?  Everything in that output shows unconfined.