Difference between revisions of "FileLabelRecipe"
(text review) |
|||
| Line 1: | Line 1: | ||
| − | + | The chcon program can change the context of a file; however, changes made with chcon are not preserved if the file is relabeled with restorecon, or if the entire file system is relabeled using "touch /.autorelabel" and then rebooting. The semanage program can make persistent customizations to the SELinux policy configuration. | |
| − | + | To run semanage, you must be the Linux root user and in a role allowed to run semanage, such as sysadm_r or unconfined_r. The following example uses semanage to set the myfile_t type for the "/path/to/myfile" file: | |
# semanage fcontext -a -t myfile_t /path/to/myfile | # semanage fcontext -a -t myfile_t /path/to/myfile | ||
| − | + | This semanage command adds an entry in the system file contexts. This entry will be persistent, even after the distribution policy is updated. If you change policies, for example, from targeted to MLS, you must re-run the above command to add the entry to the new policy. Run the restorecon command to apply the changes added via "semanage fcontext": | |
| − | + | ||
| − | + | ||
# restorecon /path/to/myfile | # restorecon /path/to/myfile | ||
# ls -Z /path/to/myfile | # ls -Z /path/to/myfile | ||
system_u:object_r:myfile_t /path/to/myfile | system_u:object_r:myfile_t /path/to/myfile | ||
Revision as of 10:19, 25 November 2009
The chcon program can change the context of a file; however, changes made with chcon are not preserved if the file is relabeled with restorecon, or if the entire file system is relabeled using "touch /.autorelabel" and then rebooting. The semanage program can make persistent customizations to the SELinux policy configuration.
To run semanage, you must be the Linux root user and in a role allowed to run semanage, such as sysadm_r or unconfined_r. The following example uses semanage to set the myfile_t type for the "/path/to/myfile" file:
# semanage fcontext -a -t myfile_t /path/to/myfile
This semanage command adds an entry in the system file contexts. This entry will be persistent, even after the distribution policy is updated. If you change policies, for example, from targeted to MLS, you must re-run the above command to add the entry to the new policy. Run the restorecon command to apply the changes added via "semanage fcontext":
# restorecon /path/to/myfile # ls -Z /path/to/myfile system_u:object_r:myfile_t /path/to/myfile
