I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on its files. I need to read and change that context for certain files. When I mount this image and ls -lZ it, I get a ? instead of context.

How do I access & change SELinux context on files if I don't have SELinux enabled systemwide? If this is impossible, then which is minimal SELinux configuration which will not influence overall system but will allow me to change contexts within a mounted image?

  • The reason I need this was modifying Android firmware. The answer below works fine. – MarSoft Feb 2 '17 at 6:53

SELinux context is stored in file's extended attributes (xattr, man 5 attr). Tools for working with them are available in core/attr package.

Attributes, including SELinux context, can be retrieved with getfattr. There is a caveat though: by default getfattr lists only attributes from user. namespace; and selinux attribute we need is in security namespace. So we need to pass -m - option to request attributes for all namespaces (-d is to dump values as well as names):

$ getfattr -m - -d bin/sh
# file: bin/sh

To change selinux context, I used setfattr tool, which required root privileges:

$ sudo setfattr -n security.selinux -v u:object_r:shell_exec:s0 bin/sh
$ getfattr -m - -d bin/sh
# file: bin/sh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.