Welcome back.
At this point we've have seen the various parts of a security context.
So we have the U.S. we have the roll.
We have the level and also the type.
We also already know that the targeted policy uses this field for type enforcement as the name suggests
only certain processes and demands yet targeted.
Everything else runs on confined.
The idea behind the targeted policy is to lock down the most vulnerable processes which are the network
face and processes and processes that start.
But this is actually a good approach to a large task securing the most vulnerable parts of the system
while leaving everything else to run on confined in the olden days only a few processes and demons ever
got targeted these days.
Just about every network facing and startup process gets confined this means use up processes are not
targeted the run in the UN confined to domain this domain is actually not the only UN confined domain
on the system.
For example if I want to list out all the UN confined domains in my current policy I can go out and
say I see info which is a UN confined domain tied to cache X let's do a quick word count
so there's over 80 of them.
Basically the targeted policy of restricts the most obvious the most likely the most vulnerable processes
over time more and more processes are included and the targeted list so targeted processes run in confined
domains and on confined processes the subject only to discretionary access controls.