I think there is a gap in my understanding of how to change one file's context permantently. After reading through https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext, I think I should be able to set a context for a file and restorecon will then use that instead of any selinux policy for that file.

However, I'm seeing a restorecon set this file (which is in my home directory), restore the type to the default type (inheriting from its parent directory), as follows:

 ~> sudo semanage fcontext -C -l
SELinux fcontext                                   type               Context

pretenddir/pretendfile                             all files          system_u:object_r:samba_share_t:s0 
~> sudo restorecon pretenddir/
~> ls -Z pretenddir/
unconfined_u:object_r:user_home_t:s0 pretendfile
~> sudo chcon -v --type=samba_share_t pretenddir/pretendfile 
changing security context of 'pretenddir/pretendfile'
~> ls -Z pretenddir/
unconfined_u:object_r:samba_share_t:s0 pretendfile
~> sudo restorecon pretenddir/pretendfile
~> ls -Z pretenddir/
unconfined_u:object_r:user_home_t:s0 pretendfile

What am I missing?


I didn't use the full path when running the semanage command.

I should have done:
# semanage fcontext -a -t samba_share_t /home/christy/pretenddir/pretendfile

instead of:
# semanage fcontext -a -t samba_share_t pretenddir/pretendfile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.