How to use the chcon command (with examples)

The chcon command is used to change the SELinux security context of a file or files/directories. SELinux (Security-Enhanced Linux) is a security feature in Linux that provides extra access controls for processes and users.

Use case 1: View security context of a file

Code:

ls -lZ path/to/file

Motivation: Sometimes, it is necessary to view the security context of a file to understand the access controls applied to it. This can be helpful for troubleshooting or auditing purposes.

Explanation: The ls -lZ command is used to list files and their security context. The -Z option displays the security context of each file.

Example output:

-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html

In this example output, the file “index.html” is owned by root and has the security context “unconfined_u:object_r:httpd_sys_content_t:s0”.

Use case 2: Change the security context of a target file, using a reference file

Code:

chcon --reference=reference_file target_file

Motivation: When you want to apply the same security context to a target file as a reference file, you can use this command. This can be useful when you want to ensure consistency in security contexts across files.

Explanation: The --reference option specifies the reference file from which the security context should be copied. The target_file argument specifies the file whose security context should be changed.

Example output: None.

Use case 3: Change the full SELinux security context of a file

Code:

chcon user:role:type:range/level filename

Motivation: This use case allows you to explicitly specify the full SELinux security context of a file. It can be useful when you have a specific security policy or requirement that needs to be enforced.

Explanation: The arguments user, role, type, and range/level specify the different components of the SELinux security context. Each component is separated by a colon (:). The filename argument specifies the file whose security context should be changed.

Example output: None.

Use case 4: Change only the user part of SELinux security context

Code:

chcon -u user filename

Motivation: Sometimes, it may be necessary to change only the user part of the SELinux security context for a file. This use case allows you to do that without affecting other components of the security context.

Explanation: The -u option specifies that only the user part of the SELinux security context should be changed. The user argument specifies the new user value. The filename argument specifies the file whose security context should be changed.

Example output: None.

Use case 5: Change only the role part of SELinux security context

Code:

chcon -r role filename

Motivation: This use case allows you to change only the role part of the SELinux security context for a file. It can be helpful when you need to modify the role without touching other components of the security context.

Explanation: The -r option specifies that only the role part of the SELinux security context should be changed. The role argument specifies the new role value. The filename argument specifies the file whose security context should be changed.

Example output: None.

Use case 6: Change only the type part of SELinux security context

Code:

chcon -t type filename

Motivation: When you want to change only the type part of the SELinux security context for a file, this use case comes in handy. It allows you to modify the type without affecting other components of the security context.

Explanation: The -t option specifies that only the type part of the SELinux security context should be changed. The type argument specifies the new type value. The filename argument specifies the file whose security context should be changed.

Example output: None.

Use case 7: Change only the range/level part of SELinux security context

Code:

chcon -l range/level filename

Motivation: This use case allows you to change only the range/level part of the SELinux security context for a file. It can be useful when you need to modify the range/level without impacting other components of the security context.

Explanation: The -l option specifies that only the range/level part of the SELinux security context should be changed. The range/level argument specifies the new range or level value. The filename argument specifies the file whose security context should be changed.

Example output: None.

Conclusion:

The chcon command is a powerful tool for managing SELinux security contexts. By using the different arguments and options, you can view and modify the security context of files to ensure proper access controls and meet security requirements.