File labels are the most common aspect of a SELinux system that users and administrators will need to care for. As SELinux policy decisions are based on the label of a resource, making sure that the file labels are correctly set is the most important part of maintaining SELinux systems.
The term label is used for the SELinux context of a file or other object on a system. Whenever a document talks about a file context or file label, both actually mean the same thing. The term comes from the SELinux permissions relabelfrom and relabelto which inform the policy if a relabel operation (change of context) is allowed from a particular label (context) or towards a particular label (context).
Label values are also often abbreviated in documents. A file with
user_home_t label (or context) actually needs to have an entire context assigned, but in the document itself the type part of the context is the most important one. As such, instead of talking about a file with
user_u:object_r:user_home_t:s0 label (and having to explain that the SELinux user part can be different) the type
user_home_t alone is used.
Labels are extended attributes
On most file systems, SELinux labels are stored as extended attributes. This is not always the case though - some file systems do not support extended attributes. In these cases, all files on the file system get assigned the same context, usually provided through the mount option of the file system.
On a SELinux system, everything needs to have a context / label assigned. Even resources such as TCP and UDP ports get a label. These labels are assigned by SELinux itself through policy definitions, although users can still manipulate the assigned port types if no specific port type is used yet.
Managing file labels
Although file labels are set as extended attributes in most cases, managing file labels goes further than just ensuring that that particular extended attribute is correctly set. The SELinux user space maintains a database of file path expressions together with the file context to be assigned to these resources. This allows administrators to verify if a file context is correct or not, and to reset the context of a file.
Listing file labels
The Linux core utilities support displaying of SELinux labels.
For instance, using
ls -Z (the
-Z option is often used for displaying SELinux contexts):
ls -lZ /etc/resolv.conf
-rw-r--r--. 1 root root system_u:object_r:net_conf_t 68 May 4 18:14 /etc/resolv.conf
stat command displays the label as well, here on an MLS-enabled system:
File: '/etc/resolv.conf' Size: 149 Blocks: 16 IO Block: 4096 regular file Device: fb02h/64258d Inode: 394204 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Context: system_u:object_r:net_conf_t:s0 Access: 2013-01-13 13:24:01.402000000 +0100 Modify: 2014-05-04 19:43:03.563000000 +0200 Change: 2014-05-04 19:43:03.573000000 +0200
The context of a file can also be directly read through the
getfattr command, used to obtain a file's extended attributes:
getfattr -m . -d /etc/resolv.conf
getfattr: Removing leading '/' from absolute path names # file: etc/resolv.conf security.evm=0sAoTjX3aOeDQdWxbOfOUV930tWoDA security.ima=0sAYC508o0Lz4iAA9ucVAVsvK02tV/ security.selinux="system_u:object_r:net_conf_t:s0"
In the above output, next to the integrity related extended attributes, the
security.selinux attribute is shown, which contains the SELinux context of the file.
Relabeling files means that the context of one or more files is reset towards the definition stored by the SELinux user space utilities.
Such a relabeling operation is usually done through the
To relabel the entire file system, use
rlpkg (which is a Gentoo-specific tool):
rlpkg -a -r
rlpkg application also supports relabeling all files provided by a single Gentoo package. For instance, to relabel all files provided by the
Temporarily modifying file labels
To set a file context, the
chcon command can be used:
chcon -t net_conf_t /etc/puppet-resolv.conf
chcon tool does not update the SELinux user space definition list. As a result, when the administrator relabels a