How to label a newly created file with "system_u"?

Question

I just created a blank conf file for freetds and noticed that the permissions are wrong:

[root@box etc]# touch freetds.conf.new
[root@box etc]# ll -lZ freetds.conf*
-rw-r--r--. root root system_u:object_r:etc_t:s0   freetds.conf
-rw-rw----. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new

So I tried:

[root@box]# semanage fcontext -a -t system_u /etc/freetds.conf.new 

But this fails with:

ValueError: Type system_u is invalid, must be a file or device type

What should I use to change the label from unconfined_u to system_u on the file freetds.conf.new?

Answer 1

A "temporary" label change is done via the chcon command:

bash-4.2# touch freetds.conf.new
bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new
bash-4.2# chcon -t etc_t -u system_u freetds.conf.new 
bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root system_u:object_r:etc_t:s0       freetds.conf.new

A permanent change would be done via the semanage command. This will add (or modify) a line in /etc/selinux/targeted/contexts/files/file_contexts.local which can then be applied with restorecon.

So, let's start again with a new file:

bash-4.2# rm freetds.conf.new
bash-4.2# touch freetds.conf.new
bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new

We can add a rule for this:

bash-4.2# semanage fcontext -a -t etc_t -s system_u /etc/freetds.conf.new
bash-4.2# cat /etc/selinux/targeted/contexts/files/file_contexts.local
# This file is auto-generated by libsemanage
# Do not edit directly.

/etc/freetds.conf.new    system_u:object_r:etc_t:s0

This hasn't changed the file yet, though

bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new

So now we apply it:

bash-4.2# restorecon -vF /etc/freetds.conf.new
restorecon reset /etc/freetds.conf.new context unconfined_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0
bash-4.2# ls -lZ /etc/freetds.conf.new
-rw-r--r--. root root system_u:object_r:etc_t:s0       /etc/freetds.conf.new

ETA: If you're going to copy the freetds.conf.new to freetds.conf after you've updated it then I'd probably stick with the chcon command; it's easier and the existing ruleset will handle relabeling when it has the right name. I'd only use the semanage form if this is to be the final name.

Answer 2

Selinux user and type are saved inside file attributes. In order to use semanage you need to install policycoreutils-python-utils package (in RHEL9). Changes made with semanage will be "persistant" the way, that restorecon will always mark such named file in such location as defined. When moved and you'll restorecon to that file it will be set to type regarding to it's current location (for example admin_home_t for /root/ directory or etc_runtime_t for files within /). It's no more "persistant" in any way for files, which can be moved freely around file system without losing attributes (even copying with cp -a copies selinux type and associated user). So using semanage to change file attributes appears to be wrong, because of the structure of /etc/selinux/targeted/contexts/files/file_contexts.local which is ruleset of file paths not linked to real file other than the path itself. chcon would change file context without using such a strict paths database and files context changed with it will be persistent across reboots, moving and copying (with -a), just like those labelled from semanage fcontext.

So the right answer for most cases would be to use

chcon -u USER /path/to/files

which marks files according to our needs within file attributes.

Moreover, you need to provide selinux type when changing associated selinux user with semanage. When in need to create such a list of files to make particular files always with same selinux labels with defined user and without changing its type you can use that command:

for i in $(find /root/* -type f) ; do semanage fcontext -a -t $(ls -Z $i | awk -F':' '{print $3}') -s SELINUX_USER $i; restorecon -v $i ; done

When file is already labelled in such a way with semange fcontext you will get an error:

ValueError: File context for /root/sth.txy already defined

and you should use –m (modify) instead of –a (add):

[root@box /]# for i in $(find /root/* -type f) ; do semanage fcontext -m -t $(ls -Z $i | awk -F':' '{print $3}') -s SELINUX_USER $i; restorecon -v $i ; done