2

I was reading the book "Linux Bible", chapter 24 to understand SELinux. In the book the author says that using $ ls -Z my_stuff in the command should display the DAC controls and RBAC controls over the file. Something like this:

$ ls -Z my_stuff
-rw-rw-r--. johndoe johndoe unconfined_u:object_r:user_home_t:s0 my_stuff

But when I tried it out in my terminal, it displays a "?" in front of all listed files/directories:

base ❯ ls -Z vim_cheatsheet.png 
? vim_cheatsheet.png

(The "?" is showing up for any file I try to view with ls -Z)

Checked the man pages of ls and that didn't give much information on this option.
Any idea what the "?" means here?

7

? means that no SELinux context was found:

Display the SELinux security context or ‘?’ if none is found.

SELinux isn’t installed or enabled by default everywhere; for example, Fedora and RHEL install and enable it by default, but Debian and Ubuntu don’t.

| improve this answer | |
  • In fact, it's not installed and enabled on most systems because it's serious overkill for most users. Fedora, RHEL, and CentOS are the anomaly here, not the rule. – Austin Hemmelgarn Aug 5 at 20:49
  • The most common version of Linux most people interact with directly, Android, enables SELinux by default ;-). (Yeah, I know, it’s not really comparable to Fedora, Debian etc.) I disagree that it’s overkill, but then I’m biased. – Stephen Kitt Aug 6 at 7:40
  • 'Overkill' is probably the wrong term for my opinion on it TBH. Outside of rare cases like Android where everything literally just works or cases like 'normal' usage of CentOS where the reference policy actually fits the way the system is being used, SELinux is too high of an opportunity cost for most users because the number of potential issues far outweigh the benefits of improved security. The same is true of most LSMs though, not just SELinux (though others do a better job of making sure things just work). – Austin Hemmelgarn Aug 7 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.