Relabeling a File or Directory
You may need to relabel a file when moving or copying into special directories related to the targeted daemons, such as ~/public_html directories, or when writing scripts that work in directories outside of /home.
There are two general types of relabeling operations:
- Deliberately changing the type of a file
- Restoring files to the default state according to policy
There are also relabeling operations that an administrator performs. These are covered in "Relabeling a File System".
The majority of SELinux permission control in the targeted policy is Type Enforcement (TE). Consequently, you can generally ignore the user and role information in a security label and focus on just changing the type. You do not normally need to consider the role and user settings on files.
If relabeling affects the label on a daemon's executable, you should restart the daemon to be sure it is running in the correct domain. For example, if /usr/sbin/mysqld has the wrong security label, and you address this by using a relabeling operation such as restorecon, you must restart mysqld after the relabeling operation. Setting the executable file to have the correct type (mysqld_exec_t) ensures that it transitions to the proper domain when started.
Use the chcon command to change a file to the correct type. You need to know the correct type that you want to apply to use this command. The directories and files in the following example are labeled with the default type defined for file system objects created in /home:
cd ~ ls -Zd public_html/ drwxrwxr-x auser auser user_u:object_r:user_home_t public_html/ ls -Z web_files/ -rw-rw-r-- auser auser user_u:object_r:user_home_t 1.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 2.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 3.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 4.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 5.html -rw-rw-r-- auser auser user_u:object_r:user_home_t index.html
If you move these files into the public_html directory, they retain the original type:
mv web_files/* public_html/ ls -Z public_html/ -rw-rw-r-- auser auser user_u:object_r:user_home_t 1.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 2.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 3.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 4.html -rw-rw-r-- auser auser user_u:object_r:user_home_t 5.html -rw-rw-r-- auser auser user_u:object_r:user_home_t index.html
To make these files viewable from a special user public HTML folder, they need to have a type that httpd has permissions to read, presuming the Apache HTTP Server is configured for UserDir and the Boolean value httpd_enable_homedirs is enabled.
chcon -R -t httpd_user_content_t public_html/ ls -Z public_html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t 1.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t 2.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t 3.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t 4.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t 5.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t index.html ls -Z public_html/ -d drwxrwxr-x auser auser user_u:object_r:httpd_user_content_t public_html/
If the file has no label, such as a file created while SELinux was disabled in the kernel, you need to give it a full label with chcon system_u:object_r:shlib_t foo.so. Otherwise, you will receive an error about applying a partial context to an unlabeled file.
Use the restorecon command to restore files to the default values according to the policy. There are two other methods for performing this operation that work on the entire file system: fixfiles or a policy relabeling operation. Each of these methods requires superuser privileges. Cautions against both of these methods appear in "Relabeling a File System".
The following example demonstrates restoring the default user home directory context to a set of files that have different types. The first two sets of files have different types, and are being moved into a directory for archiving. Their contexts are different from each other, and are incorrect for a standard user's home directory:
ls -Z /tmp/
-rw-rw-r-- auser auser user_u:object_r:tmp_t /tmp/file1
-rw-rw-r-- auser auser user_u:object_r:tmp_t /tmp/file2
-rw-rw-r-- auser auser user_u:object_r:tmp_t /tmp/file3
mv /tmp/{1,2,3} archives/
mv public_html/* archives/
ls -Z archives/
-rw-rw-r-- auser auser user_u:object_r:tmp_t file1
-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t file1.html
-rw-rw-r-- auser auser user_u:object_r:tmp_t file2
-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t file2.html
-rw-rw-r-- auser auser user_u:object_r:tmp_t file3
-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t file3.html
-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t file4.html
-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t file5.html
-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t index.html
The archives/ directory already has the default type because it was created in the user's home directory:
ls -Zd archives/ drwxrwxr-x auser auser user_u:object_r:user_home_t archives/
Using the restorecon command to relabel the files uses the default file contexts set by the policy, so these files are labeled with the default label for their current directory.
/sbin/restorecon -R archives/ ls -Z archives/ -rw-rw-r-- auser auser system_u:object_r:user_home_t file1 -rw-rw-r-- auser auser system_u:object_r:user_home_t file1.html -rw-rw-r-- auser auser system_u:object_r:user_home_t file2 -rw-rw-r-- auser auser system_u:object_r:user_home_t file2.html -rw-rw-r-- auser auser system_u:object_r:user_home_t file3 -rw-rw-r-- auser auser system_u:object_r:user_home_t file3.html -rw-rw-r-- auser auser system_u:object_r:user_home_t file4.html -rw-rw-r-- auser auser system_u:object_r:user_home_t file5.html -rw-rw-r-- auser auser system_u:object_r:user_home_t index.html