SELinux contexts and labels - inspecting and fixing

SELinux contexts determine what processes can access. Mislabeled files are a common cause of AVC denials. This lesson covers inspecting, restoring, and setting contexts.

Read contexts

ls -lZ /var/www/html/    # files
ps -eZ | grep nginx       # processes
ss -tlnpZ                 # ports
id -Z                     # current user context

The -Z flag is the standard option for showing SELinux contexts. Every command that touches a labelled object supports it.

File context format

user:role:type:sensitivity:category

Examples:

system_u:object_r:httpd_sys_content_t:s0 index.html
system_u:object_r:etc_t:s0 /etc/passwd
system_u:object_r:admin_home_t:s0 /root

In production, the relevant fields are user, role, type, and sensitivity. Categories are used in MLS policy.

Why contexts matter

The policy says: “process of type X can read files of type Y”. A web server (type httpd_t) reading a file with type shadow_t (the type for /etc/shadow) is denied, even though DAC would allow it for some users.

A common mistake: deploying a new application to a directory with the wrong context. The application works in permissive mode but fails in enforcing mode.

Restore contexts

When files are mislabeled (e.g. restored from backup, copied from another host, on a new filesystem), restore their context:

sudo restorecon -R /var/www/html
sudo restorecon -v /etc/passwd     # verbose

-R is recursive. -v shows each file’s context change. restorecon reads the policy and applies the expected context.

Set new contexts

To make a context change persistent across restorecon and across file relocations, register the path in the policy:

sudo semanage fcontext -a -t httpd_sys_content_t '/srv/web(/.*)?'
sudo restorecon -R /srv/web

semanage fcontext -a adds a file-context mapping. The pattern /srv/web(/.*)? matches /srv/web and everything under it.

To remove a mapping:

sudo semanage fcontext -d '/srv/web(/.*)?'

To see existing mappings:

sudo semanage fcontext -l | grep '/srv/web'

Common context types

Process and port contexts

Processes inherit context from their parent:

ps -eZ | grep httpd
# system_u:system_r:httpd_t:s0 ... /usr/sbin/httpd

Ports have contexts too:

sudo semanage port -l | grep http
# http_port_t: tcp 80, 443, 488, 8008, 8009, 8443

To allow a service to bind a non-standard port:

sudo semanage port -a -t http_port_t -p tcp 8080

Diagnose mislabeled files

Symptom: AVC denials involving file reads that should succeed.

sudo ausearch -m avc -ts recent | grep -E 'tcontext.*etc_t'

If the target context is etc_t for a file that should be httpd_sys_content_t, the file is mislabeled.

ls -lZ /var/www/html/index.html
sudo restorecon -v /var/www/html/index.html

Knowledge check