LFCS 141 🐧 SELinux — Contexts and Labels - KandZ

⏱️ Estimated read: 11 min | |

The previous chapter introduced the SELinux modes: Enforcing, Permissive, and Disabled. This chapter covers the data that the policy actually evaluates: the security context. Every process, file, directory, and socket in a SELinux system carries a label, and the policy rules match on the type field of that label, not on the file path or the traditional Unix permissions. The LFCS exam tests the context format, the commands that display the context, and the distinction between the temporary chcon command and the persistent semanage fcontext plus restorecon workflow. The critical trap is that chcon appears to fix the problem but is reverted on the next full relabel, which is exactly what happens after a policy update or a reboot with /.autorelabel .

Key point: A SELinux context has four colon-separated fields: user:role:type:level. The type is the field that policy rules use. The ls -Z command shows the context of a file, ps -Z shows the context of a process, and id -Z shows the context of the current shell. The chcon command changes the context temporarily. The persistent change requires semanage fcontext -a followed by restorecon.

Why contexts and labels require a specific mental model

The type enforcement problem. The policy is a table of rules in the form “domain X may perform action Y on type Z.” A process runs in a domain (a type for processes), such as httpd_t for the Apache web server. A file has a type, such as httpd_sys_content_t for the default web root. The rule allow httpd_t httpd_sys_content_t : file { read open }; permits the web server to read the web root. There is no rule that permits httpd_t to read user_home_t (the type for user home directories), so the web server cannot read files in /home/user/ even if the Unix permissions are 777 . This is the core of mandatory access control: the policy overrides the discretionary permissions.

The label inheritance problem. A new file created in a directory inherits the directory’s type by default. A file copied into /var/www/html/ with cp receives the httpd_sys_content_t type because the destination directory has that type. A file moved into the directory with mv on the same filesystem keeps its original type, because mv only renames the inode and does not relabel it . This is the most common source of labeling problems: an administrator moves a file from /home/user/ to /var/www/html/, and the web server cannot read it because the file still has the user_home_t type.

The persistence problem. The chcon command changes the context of a file directly. The change is visible immediately, and the application starts working. But the change is not recorded in the policy’s file-context database. The next time a full relabel runs—after a policy update, a restorecon -R /, or a reboot with /.autorelabel—the file is reset to the type that the database says it should have, and the application breaks again . The persistent fix requires adding a rule to the database with semanage fcontext and then applying it with restorecon.

The display problem. The ls -Z flag shows the context of a file. The ps -Z flag shows the context of a process. The id -Z flag shows the context of the current shell. The -Z flag is the universal “show the SELinux context” flag, and it works on ls, ps, id, cp, and netstat . The context is stored in the file’s extended attributes, not in the file’s content or permissions.

The trade-off. chcon is fast and useful for testing. semanage fcontext is slower and requires the policycoreutils-python-utils package, but the change survives relabels. The exam tests both, and the correct answer for a persistent fix is always the semanage plus restorecon combination.

a. The four context fields and the display commands

The context has four fields separated by colons: user:role:type:level.

unconfined_u:object_r:httpd_sys_content_t:s0

The user is the SELinux user (not the Linux user). The role is the RBAC role. The type is the field that policy rules use. The level is the MLS/MCS sensitivity, which is s0 on almost every targeted-policy system .

The ls -Z command shows the context of a file.

ls -Z /var/www/html/index.html
# unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html

The ps -Z command shows the context of a process.

ps -eZ | grep httpd
# system_u:system_r:httpd_t:s0    1842 ?  00:00:00 httpd

The id -Z command shows the context of the current shell.

id -Z
# unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

The matchpathcon -V command compares a file’s current context to the default that the policy database expects.

matchpathcon -V /var/www/html/*
# /var/www/html/file1 has context ...:samba_share_t:s0, should be ...:httpd_sys_content_t:s0

The matchpathcon output is the diagnostic tool: it shows the current type and the expected type. If they differ, the file is mislabeled .

b. Temporary relabel with `chcon`

The chcon command changes the context of a file directly. The -t flag changes the type.

chcon -t httpd_sys_content_t /var/www/html/uploads/report.txt

The change is immediate. The ls -Z confirms the new type. The application can now access the file. But the change is not in the database. The next restorecon resets the file to the type that the database specifies, which is the type of the parent directory if no specific rule exists .

The chcon command is useful for testing a hypothesis: “If the file had this type, would the application work?” If the answer is yes, the next step is the persistent fix. If the answer is no, the problem is not the type.

c. Persistent relabel with `semanage fcontext` and `restorecon`

The persistent fix has two steps. The first is adding a rule to the file-context database. The second is applying the rule.

# Step 1: add the rule
semanage fcontext -a -t httpd_sys_content_t "/srv/myweb(/.*)?"

# Step 2: apply the rule
restorecon -Rv /srv/myweb

The -a flag adds a new rule. The -t flag specifies the target type. The pattern is a POSIX regular expression. The (/.*)? matches the directory and everything under it .

The restorecon -Rv command applies the database rules recursively. The -R flag is recursive. The -v flag is verbose, which shows each file that was relabeled. The output is the confirmation that the fix worked.

Relabeled /srv/myweb from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /srv/myweb/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

The semanage fcontext -l command lists the current rules. The semanage fcontext -d command deletes a rule. The restorecon command reads the database and applies the rules to the files.

The semanage command requires the policycoreutils-python-utils package on RHEL-family systems. The restorecon command is part of the policycoreutils package, which is installed by default .

Complete Example Session

# ============================================
# PART 1: DISPLAY THE CONTEXT
# ============================================

ls -Z /var/www/html/index.html
# unconfined_u:object_r:httpd_sys_content_t:s0 ...

# ============================================
# PART 2: CHECK A MISLABELED FILE
# ============================================

ls -Z /var/www/html/uploads/report.txt
# unconfined_u:object_r:default_t:s0 ...

# ============================================
# PART 3: DIAGNOSE WITH MATCHPATHCON
# ============================================

matchpathcon -V /var/www/html/uploads/report.txt
# ... has context ...:default_t:s0, should be ...:httpd_sys_content_t:s0

# ============================================
# PART 4: TEMPORARY FIX WITH CHCON
# ============================================

chcon -t httpd_sys_content_t /var/www/html/uploads/report.txt
ls -Z /var/www/html/uploads/report.txt
# unconfined_u:object_r:httpd_sys_content_t:s0 ...

# ============================================
# PART 5: OBSERVE THE REVERT
# ============================================

restorecon -v /var/www/html/uploads/report.txt
# Relabeled ... from ...:httpd_sys_content_t:s0 to ...:default_t:s0

# ============================================
# PART 6: PERSISTENT FIX
# ============================================

semanage fcontext -a -t httpd_sys_content_t "/var/www/html/uploads(/.*)?"
restorecon -Rv /var/www/html/uploads
# Relabeled ... from ...:default_t:s0 to ...:httpd_sys_content_t:s0

# ============================================
# PART 7: VERIFY THE PERSISTENT FIX
# ============================================

ls -Z /var/www/html/uploads/report.txt
# unconfined_u:object_r:httpd_sys_content_t:s0 ...

# ============================================
# PART 8: CHECK THE DATABASE
# ============================================

semanage fcontext -l | grep uploads
# /var/www/html/uploads(/.*)?  ...  httpd_sys_content_t

# ============================================
# PART 9: REMOVE THE RULE (CLEANUP)
# ============================================

semanage fcontext -d "/var/www/html/uploads(/.*)?"
restorecon -Rv /var/www/html/uploads

The nine parts trace the context workflow: display, mislabeled check, diagnosis, temporary fix, revert observation, persistent fix, verification, database check, and cleanup.

Quick Reference

Context Fields

Field	Meaning
`user`	SELinux user (`unconfined_u`, `system_u`)
`role`	RBAC role (`object_r`, `system_r`)
`type`	Policy type (`httpd_t`, `httpd_sys_content_t`)
`level`	MLS/MCS sensitivity (`s0`)

Display Commands

Command	Purpose
`ls -Z`	File context
`ps -Z`	Process context
`id -Z`	Shell context
`matchpathcon -V`	Compare to default

Relabel Commands

Command	Persistence
`chcon -t <type>`	Temporary
`semanage fcontext -a -t <type> "<pattern>"`	Persistent database
`restorecon -Rv <path>`	Applies database
`semanage fcontext -d "<pattern>"`	Remove rule

Common Types

Type	Use
`httpd_t`	Apache process domain
`httpd_sys_content_t`	Web content (read)
`httpd_sys_rw_content_t`	Web content (read/write)
`var_t`	`/var` directory
`user_home_t`	User home files
`default_t`	Unspecified files

Best Practices

✅ Do This:

semanage fcontext -a -t httpd_sys_content_t "/srv/myweb(/.*)?"
restorecon -Rv /srv/myweb
<!-- Persistent fix for a non-standard path -->       # ✅

matchpathcon -V /var/www/html/*
<!-- Diagnose mislabeled files -->                   # ✅

ps -Z | grep httpd
<!-- Check the process domain -->                    # ✅

❌ Don’t Do This:

chcon -t httpd_sys_content_t /srv/myweb/index.html
<!-- Reverted on next relabel -->                    # ❌

# Move files with mv into a web root
<!-- Keeps original label; use cp or restorecon -->  # ❌

# Assume Unix permissions are the only access control
<!-- SELinux type is checked after DAC -->           # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
File inaccessible despite `chmod 777`	Wrong SELinux type	`semanage fcontext` + `restorecon`
`chcon` fix disappears	Relabel reset the type	Use `semanage fcontext`
Moved file not readable	`mv` kept the original label	`restorecon` on the destination
`semanage` not found	Package not installed	`dnf install policycoreutils-python-utils`
Context reverts after reboot	`/.autorelabel` triggered a full relabel	Persistent rule needed

Real-World Examples

1. Display File Context

ls -Z /var/www/html/index.html

2. Display Process Context

ps -Z | grep httpd

3. Display Shell Context

id -Z

4. Diagnose Mislabel

matchpathcon -V /var/www/html/*

5. Temporary Relabel

chcon -t httpd_sys_content_t /var/www/html/file1

6. Persistent Rule

semanage fcontext -a -t httpd_sys_content_t "/srv/myweb(/.*)?"

7. Apply Persistent Rule

restorecon -Rv /srv/myweb

8. List Rules

semanage fcontext -l | grep myweb

9. Remove Rule

semanage fcontext -d "/srv/myweb(/.*)?"

10. Restore Default

restorecon -Rv /var/www/html

Visual

Context Fields

┌──────────────────────────────────────────────┐
│  unconfined_u : object_r : httpd_sys_content_t : s0 │
│  ──────┬─────   ────┬───   ─────────┬─────────   ─┬─ │
│      user        role          type         level│
│                                              │
│  Policy rules match on the type field.       │
└──────────────────────────────────────────────┘

Temporary vs Persistent

┌──────────────────────────────────────────────┐
│  chcon -t httpd_sys_content_t file          │
│  → Immediate change                          │
│  → Not in database                           │
│  → Reverted on next relabel                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  semanage fcontext -a -t httpd_sys_content_t │
│  → Rule added to database                    │
│  → restorecon applies it                     │
│  → Survives relabels                         │
└──────────────────────────────────────────────┘

Summary

Item	Value
Context format	`user:role:type:level`
Policy field	`type`
File context	`ls -Z`
Process context	`ps -Z`
Shell context	`id -Z`
Diagnose	`matchpathcon -V`
Temporary relabel	`chcon -t`
Persistent database	`semanage fcontext -a`
Apply database	`restorecon -Rv`

Key takeaways:

The type field is the policy’s decision point. The policy rules match on the process domain (httpd_t) and the file type (httpd_sys_content_t). The Unix permissions are checked first; the SELinux type is checked second .
ls -Z, ps -Z, and id -Z are the display commands. The -Z flag shows the context on files, processes, and the shell. The matchpathcon -V compares a file’s context to the default .
chcon is temporary. The change is not recorded in the database. The next restorecon or full relabel reverts the file to the type the database expects. The chcon command is for testing, not for the final fix .
semanage fcontext plus restorecon is persistent. The semanage command adds the rule to the database. The restorecon command applies it. The -R flag is recursive, and the -v flag shows the changes .
The mv command preserves the original label. A file moved from /home/user/ to /var/www/html/ keeps the user_home_t type, and the web server cannot read it. The cp command gives the destination’s type. The restorecon command fixes the mv case .

Remember: The context is the label. The type is the policy. The ls -Z is the display. The chcon is the temporary. The semanage is the persistent. The restorecon is the apply. The mv is the trap. The exam tests the context fields and the persistence distinction.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Why contexts and labels require a specific mental model

a. The four context fields and the display commands

b. Temporary relabel with chcon

c. Persistent relabel with semanage fcontext and restorecon

Complete Example Session

Quick Reference

Context Fields

Display Commands

Relabel Commands

Common Types

Best Practices

Common Pitfalls

Real-World Examples

1. Display File Context

2. Display Process Context

3. Display Shell Context

4. Diagnose Mislabel

5. Temporary Relabel

6. Persistent Rule

7. Apply Persistent Rule

8. List Rules

9. Remove Rule

10. Restore Default

Visual

Context Fields

Temporary vs Persistent

Summary

b. Temporary relabel with `chcon`

c. Persistent relabel with `semanage fcontext` and `restorecon`