How to use the command 'semanage fcontext' (with examples)

The semanage fcontext command is used for managing persistent SELinux (Security Enhanced Linux) security context rules for files and directories. SELinux is a security architecture aimed at providing robust and flexible access controls on Linux systems. The command enables administrators to define custom security labeling rules, ensuring the correct SELinux context is applied to files and directories, tailored to the unique security policies of an organization’s environment.

Use case 1: List all file labelling rules

Code:

sudo semanage fcontext --list

Motivation: Understanding the existing SELinux file labeling rules within your system is crucial, especially when troubleshooting access control issues or planning to introduce new applications that require specific security contexts. By listing all rules, you get a comprehensive overview of how files and directories are currently labeled, allowing for informed decision-making.

Explanation:

• sudo: This prefix executes the command with superuser privileges, necessary for accessing SELinux management functions.
• semanage fcontext: The base command used to manage SELinux file context rules.
• --list: This option lists all the file labeling rules currently applied in the system, enabling you to view both default and custom rules.

Example output:

/var/www(/.*)? all files          system_u:object_r:httpd_sys_content_t:s0 
/home/user/myapp(/.*/)? all files unconfined_u:object_r:user_tmp_t:s0

Use case 2: List all user-defined file labelling rules without headings

Code:

sudo semanage fcontext --list --locallist --noheading

Motivation: When you specifically need to review any custom file labeling rules added by users without the clutter of default rules and headings, this command streamlines the output. This is especially useful for audits or when evaluating the impact of personal or organizational alterations to the SELinux policy.

Explanation:

• sudo: Executes the command with elevated privileges.
• semanage fcontext: The command targeted at managing file contexts.
• --list: Displays the current file context rules.
• --locallist: Filters the list to show only user-added rules, focusing solely on custom entries.
• --noheading: Removes any header information from the output to enhance readability.

Example output:

/var/lib/myapp(/.*)?    all files  user_u:object_r:myapp_data_t:s0

Use case 3: Add a user-defined rule that labels any path which matches a PCRE regex

Code:

sudo semanage fcontext --add --type samba_share_t '/mnt/share(/.*)?'

Motivation: When you need to ensure that a specific directory and its contents consistently receive a specific SELinux context type, regardless of future changes, adding a user-defined rule is key. For instance, if files in /mnt/share are intended for sharing and require the samba_share_t type, this command ensures uniform labeling automatically.

Explanation:

• sudo: Executes the command with the required privileges.
• semanage fcontext: Engages the file context management function.
• --add: Indicates an intention to add a new rule to the system.
• --type samba_share_t: Specifies samba_share_t as the SELinux type to label on the files matching the regex.
• '/mnt/share(/.*)?': A PCRE regex pattern that matches /mnt/share and recursively any file or subdirectory within, directing them to be assigned the samba_share_t type.

Example output:

SELinux policy fcontext added

Use case 4: Delete a user-defined rule using its PCRE regex

Code:

sudo semanage fcontext --delete '/mnt/share(/.*)?'

Motivation: Over time, organizational needs evolve, resulting in changes to the file structure or purpose that outdated security rules may not accurately reflect. Removing a user-defined rule via its regex expression is essential when a directory’s function changes, preventing mismatched labeling that could cause security issues or access disruptions.

Explanation:

• sudo: Required privilege level for policy modification.
• semanage fcontext: Dedicated command for managing file context rules.
• --delete: Command option to remove a specified file context rule.
• '/mnt/share(/.*)?': Regex pattern for the rule to be deleted, ensuring that labels applied to /mnt/share and its subdirectories are no longer automatically assigned.

Example output:

SELinux policy fcontext deleted

Use case 5: Relabel a directory recursively by applying the new rules

Code:

restorecon -R -v path/to/directory

Motivation: Changes in SELinux rules necessitate relabeling files to ensure the correct security contexts are applied. Especially after updating file context rules or moving directories, relabeling assures compliance with SELinux policies. This command is vital for maintaining expected security configurations in dynamic environments.

Explanation:

• restorecon: The command responsible for restoring file attributes to match the current SELinux policy.
• -R: The recursive flag ensures that the operation applies to all subdirectories and files within the specified path.
• -v: This verbose option outputs detailed information about the actions taken, assisting in confirming successful relabeling.
• path/to/directory: Specifies the target directory to which new SELinux rules should be applied.

Example output:

Relabeled /path/to/directory/foo
Relabeled /path/to/directory/bar.txt

Conclusion:

The semanage fcontext command provides vital functionality for managing SELinux security contexts, tailoring file labeling to meet security requirements efficiently and securely. By leveraging these use cases, administrators can adequately maintain, audit, and update security labels, ensuring a robust and compliant SELinux protected system.