What does the Restorecon command do?
Using the restorecon command is the most popular and preferred way of modifying the SELinux context of a file or directory. As is visible from the name of the restorecon command, it is used to restore the default context of a file or directory by reading the default rules set in the SELinux policy.
When would you use a Restorecon?
Use restorecon command to set file security contexts. This command is primarily used to set the security context (extended attributes) on one or more files.
Is Restorecon persistent?
The setfiles utility is used when a file system is relabeled and the restorecon utility restores the default SELinux contexts. This means that changes made by semanage fcontext are persistent, even if the file system is relabeled.
What is Autorelabel in Linux?
AUTORELABEL This is an optional entry that allows the file system to be relabeled. If set to 0 and there is a file called . autorelabel in the root directory, then on a reboot, the loader will drop to a shell where a root login is required. An administrator can then manually relabel the file system.
How do I turn SELinux off?
Disable SELinux
- If editing the config file, Open the /etc/selinux/config file (in some systems, the /etc/sysconfig/selinux file).
- Change the line SELINUX=enforcing to SELINUX=permissive .
- Save and close the file.
- Reboot your system.
What do I need to know about restorecon in Linux?
This manual page describes the restorecon program. This program is primarily used to set the security context (extended attributes) on one or more files. It can be run at any time to correct errors, to add support for new policy, or with the -n option it can just check whether the file contexts are all as you expect.
How to change SELinux context in restorecon command?
Here should give specify the full-path of the filename including the directory. To specify this input file in the restorecon, use the -f option as shown below. This will change the SELinux context for only about.html and data.html as shown below. Use ls -lZ command to verify that only those two files security context is changed.
How does restorecon change the security context of a file?
If a file object has a context, restorecon will only modify the type portion of the security context. The -F option will force a replacement of the entire context. It is the same executable as setfiles but operates in a slightly different manner depending on its argv [0].
When to use restorecon to reset the label?
If a file is labeled with customizable SELinux type (for list of customizable types see /etc/selinux/ {SELINUXTYPE}/contexts/customizable_types), restorecon won’t reset the label unless the -F option is used. It is the same executable as setfiles but operates in a slightly different manner depending on its argv [0].