4

I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on its files. I need to read and change that context for certain files. When I mount this image and ls -lZ it, I get a ? instead of context.

How do I access & change SELinux context on files if I don't have SELinux enabled systemwide? If this is impossible, then which is minimal SELinux configuration which will not influence overall system but will allow me to change contexts within a mounted image?

1
  • The reason I need this was modifying Android firmware. The answer below works fine.
    – MarSoft
    Feb 2, 2017 at 6:53

1 Answer 1

5

SELinux context is stored in file's extended attributes (xattr, man 5 attr). Tools for working with them are available in core/attr package.

Attributes, including SELinux context, can be retrieved with getfattr. There is a caveat though: by default getfattr lists only attributes from user. namespace; and selinux attribute we need is in security namespace. So we need to pass -m - option to request attributes for all namespaces (-d is to dump values as well as names):

$ getfattr -m - -d bin/sh
# file: bin/sh
security.selinux="u:object_r:system_file:s0"

To change selinux context, I used setfattr tool, which required root privileges:

$ sudo setfattr -n security.selinux -v u:object_r:shell_exec:s0 bin/sh
$ getfattr -m - -d bin/sh
# file: bin/sh
security.selinux="u:object_r:shell_exec:s0"
4
  • Works marvelously for files. But what about symbolic links?
    – Adam Bliss
    Sep 15, 2020 at 20:48
  • 1
    @AdamBliss If you want to change attributes (e.g. selinux context) for symlink itself rather than referenced file, just pass -h or --no-dereference option to getfattr or setfattr.
    – MarSoft
    Sep 16, 2020 at 23:38
  • Thanks. That does work. Any idea why xattr doesn't work on symbolic links, or why its man page claims that symlinks don't have extended attributes?
    – Adam Bliss
    Sep 17, 2020 at 11:58
  • 1
    There are various namespaces of extended attributes. The sentence about attrs not being supported for symlinks is in User extended attributes paragraph of xattr(7) manpage, it only applies to attributes in user.* namespace. Other namespaces, like security and others, are valid and hence are supported by setfattr.
    – MarSoft
    Sep 18, 2020 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .