Return to Answer

The file context on the default location can be used as template to for the new location. Most policy modules include man page documentation (generated using sepolicy manpages) explaining possible alternative file contexts with their semantics.

To add a new entry to file context database:

After new context entry is added to the database, the context from database can be applied on your files using restorecon <files>.

New file context is specified in the arguments to chcon. When used with --reference= option, the security context from a reference file is copied to the target files.

The file context on the default location can be used as template to for the new location. Most policy modules include man page documentation (generated using sepolicy manpages) explaining possible alternative file contexts with their access semantics.

File context database uses regualr expression syntax, which allows writing overlapping specifications. It is worthwhile to note that applied context is the last specification found ^[src].

To add a new entry to file context database:

After new context entry is added to the database, the context from database can be applied on your files using restorecon <files>. Running restorecon with -vn flags will show what file contexts would be changed without applying any changes.

New file context is specified in the arguments to chcon. When used with --reference= option, the security context from a reference file is copied to the target files.

using a specific context (default_t):

chcon -t default_t <target files> 

or using a reference:

This method works best when there are only a few security contexts involved. In a complex configuration you quite likely have to write your own policy module. Some resources for getting started are gentoo wiki and the reference policy API documentation.

SELinux assings a label, called security context, to every object (file, process, etc) in the system:

SELinux policy contains the rules that specify which operations between contexts are allowed. SELinux operates on whitelist rules, anything not explicily allowed by the policy is denied. The reference policy contains policy modules for many applications and it is usually the policy used by SELinux enabled distributions. This answer is primarly describing how to work with a policy based on the reference policy, which you are most likely using if you using the distribution provided policy.

When files are in a non default location (not described in default policy) the issues are often related to the following reasons:

If the files are not used by another deamon (or other confined process) and the only change is the location where files are stored, the required changes to SELinux configuration are:

SELinux assigns a label, called security context, to every object (file, process, etc) in the system:

SELinux policy contains the rules that specify which operations between contexts are allowed. SELinux operates on whitelist rules, anything not explicitly allowed by the policy is denied. The reference policy contains policy modules for many applications and it is usually the policy used by SELinux enabled distributions. This answer is primarily describing how to work with a policy based on the reference policy, which you are most likely using if you use the distribution provided policy.

When files are in a non-default location (not described in default policy) the issues are often related to the following reasons:

If the files are not used by another daemon (or other confined process) and the only change is the location where files are stored, the required changes to SELinux configuration are: