Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've done a lot of chcon-ing lately,but if I understand it correctly, these will be erased on the next relabel. Is there any way to make the current contexts (preferably just under a certain directory) permanent? I understand there's a way to do it using semanage, but that means going back through and checking the context of every file and invoking semanage to set a rule. So is there some automated way to do it?

share|improve this question

migrated from security.stackexchange.com Jan 22 '12 at 13:30

This question came from our site for Information security professionals.

2 Answers 2

up vote 3 down vote accepted

First up, you are correctin that semanage fcontext -a -t <type> <filepattern> makes file changes permanent by adding them to the policy - you'll need to relabel or restorecon -R -v <filepattern> to apply those changes. chcon does not alter policy, just the on-disk context.

You can generate a list of differences to your labelled policy with matchpathcon, specifically:

matchpathcon -V /path/to/file

Unfortunately it has no recursive option, probably due to the fact that walking the tree would be expensive, but you could drive it with:

find / -exec matchpathcon -V {} \;

However, be careful. I believe find will traverse all file system mounts including filesystems without extended attributes (xattrs) which might cause problems. Of course, if all your file systems have extended attributes there isn't a problem.

Once you have this list, you could then write a script to pick out those you'll semanage. I don't know of an automated way to do this in one hit, however.

share|improve this answer

Using matchpathcon with find is very slow. Why not use restorecon?

restorecon -rnv /path/to/dir

the flags are recursive, no-changes, and verbose.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.