 file, it will be reset to the original value.
Permanently modifying file labels
To ensure that a new file context remains, even after a relabeling operation, the administrator needs to update the SELinux user space definition list first.
The definition list uses PCRE-based regular expressions and can be managed through
For instance, to add /etc/puppet-resolv.conf to the list and assign it the
semanage fcontext -a -t net_conf_t "/etc/puppet-resolv\.conf"
The use of PCRE expressions allows for a denser set of rules that matches entire subdirectories easily:
semanage fcontext -a -t bin_t "/usr/lib/portage/bin(/.*)?"
After updating the definition list, the context of the file(s) isn't set yet. For this, the files need to be relabeled:
restorecon -R /etc/puppet-resolv.conf /usr/lib/portage/bin
Managing TCP and UDP port labels
TCP and UDP ports also get assigned a particular label.
Listing port labels
seinfo, the context for a particular port can be viewed:
portcon tcp 80 system_u:object_r:http_port_t portcon tcp 1-511 system_u:object_r:reserved_port_t portcon udp 1-511 system_u:object_r:reserved_port_t
It is also possible to list all port definition declarations using
semanage port -l | grep http
http_cache_port_t tcp 3128, 8080, 8118, 10001-10010 http_cache_port_t udp 3130 http_port_t tcp 8888, 80, 443, 488, 8008, 8009, 8443 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989
Modifying port labels
If a port is not only assigned the
hi_reserved_port_t label, then the context for that port cannot be modified.
However, if the port only has one of these types assigned, then it is possible to set a specific type.
For instance, to assign the type
http_port_t to port 9980, first check if it is possible:
portcon udp 1024-65535 system_u:object_r:unreserved_port_t portcon tcp 1024-65535 system_u:object_r:unreserved_port_t
It is possible, so now use
semanage port to assign it:
semanage port -a -t http_port_t -p tcp 9980
Managing process labels
The label of a process is decided by the SELinux policy, and is called a domain.
It is not possible to relabel a process. To have a process run in a different domain, it might be possible to launch the command using the
runcon command. However, in the majority of cases, this will not be allowed by the SELinux policy. The domain in which a process runs is fully policy-driven (with a small configurable aspect provided for SELinux-aware applications).
Listing process labels
The standard core utilities can display the context of a process.
For instance, to get the context of the
ps -eZ | grep init
system_u:system_r:init_t 1 ? 00:00:01 init
Label management is one of the most core competences that a system administrator on a SELinux system must have. As SELinux decisions are based on labels (contexts), ensuring that the right context is used on all resources is a primary concern for all administrators.