Contents
What is the chcon command in SELinux for?
In SELinux, one of the frequent task that you may do is to change the security context of an object. For this, you’ll use chcon command. chcon stands for Change Context. This command is used to change the SELinux security context of a file.
How to change the security context of an object in SELinux?
In SELinux, one of the frequent task that you may do is to change the security context of an object. For this, you’ll use chcon command. chcon stands for Change Context. This command is used to change the SELinux security context of a file. This tutorial explains the following chcon command examples:
How to change the security context in chcon?
The following is the current security context of the httpd.conf file. In the above example, “admin_home_t” is the TYPE part of the security context. Using chcon -t option, we can change only the type part of the security context.
Which is the default behavior of chcon command?
This is the default behavior of chcon command. i.e It will change the context of the file it is pointing to instead of the symbolic link itself. This behavior is called as de-referencing. Chcon has an option called –dereference which will change the file instead of the symbolic link.
How to change the security context of a SELinux file?
To view security context of a file, use -Z (uppercase Z) option in the ls command as shown below. In the above example, the security context of the httpd.conf file is the following: That is a wrong SELinux context for the httpd.conf file that is under /etc/httpd/conf directory. So, to change the security context, use the following chcon command.
How to change the user context in chcon?
The following is the current security context of the httpd.conf file. In the above example, “unconfined_u” is the USER part of the security context. Using chcon -u option, we can change only the user part of the security context. In the following example, we are setting the user part of the security context to system_u for the httpd.conf file.
What happens to the file system when SELinux is disabled?
Actions made while SELinux is disabled may result in the file system no longer having the correct security context. That is, the security context defined by the policy. The best way to relabel the file system is to create the flag file /.autorelabeland reboot the machine.
How to change the type of a SELinux file?
As the Linux root user, run the chcon -R -t httpd_sys_content_t /web/ command to change the type of the /web/ directory (and its contents) to httpd_sys_content_t : Refer to the chcon(1) manual page for further information about chcon .
What is the context for file1 in SELinux?
In this example, the SELinux context for file1 includes the SELinux unconfined_u user, object_r role, user_home_t type, and the s0 level. For a description of each part of the SELinux context, refer to Chapter 3, SELinux Contexts .