安全增强型 Linux (SELinux) 是一种强制访问控制（MAC）系统，它通过将称为 SELinux 上下文 的安全标签应用于每个系统对象来实现访问权限。SELinux 策略模块使用 SELinux 上下文来定义进程、文件、端口和其他系统对象之间如何交互的规则。系统对象之间的交互仅在策略规则允许的情况下才允许。Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) system that implements access rights by applying a security label referred to as an SELinux context to each system object. SELinux policy modules use SELinux contexts to define rules for how processes, files, ports, and other system objects interact with each other. Interaction between system objects is only permitted if a policy rule allows it.

SELinux 上下文（应用于系统对象的标签）具有以下字段：user、role、type 和 security level。在定义进程与其他系统对象交互的规则时，通常更常使用类型信息，而不是整个 SELinux 上下文。例如，MySQL SELinux 策略模块使用 type 信息来定义策略规则。An SELinux context (the label applied to a system object) has the following fields: user, role, type, and security level. Type information rather than the entire SELinux context is used most commonly to define rules for how processes interact with other system objects. MySQL SELinux policy modules, for example, define policy rules using type information.

你可以使用操作系统命令查看 SELinux 上下文，例如使用 ls 和 ps 并带上 -Z 选项。假设 SELinux 已启用并且 MySQL 服务器正在运行，以下命令显示 mysqld 进程和 MySQL 数据目录的 SELinux 上下文：You can view SELinux contexts using operating system commands such as ls and ps with the -Z option. Assuming that SELinux is enabled and a MySQL Server is running, the following commands show the SELinux context for the mysqld process and MySQL data directory:

mysqld 进程：mysqld process:

$> ps -eZ | grep mysqld
system_u:system_r:mysqld_t:s0    5924 ?        00:00:03 mysqld

MySQL 数据目录：MySQL data directory:

$> cd /var/lib
$> ls -Z | grep mysql
system_u:object_r:mysqld_db_t:s0 mysql

位置：where:

有关解释 SELinux 上下文的更多信息，请参阅您所使用发行版的 SELinux 文档。For more information about interpreting SELinux contexts, refer to your distribution's SELinux documentation.