Modifying file contexts

We now know how to set SELinux contexts, both directly through tools such as chcon as well as through the restorecon application, which queries the SELinux context list to know what context a file should have. Yet restorecon is not the only application that considers this context list.

Using setfiles, rlpkg, and fixfiles

The setfiles application is an older one, which requires the path to the context list file itself to reset contexts. It is often used under the hood of other applications, so most administrators do not need to call setfiles directly anymore:

# setfiles /etc/selinux/targeted/contexts/files/file_contexts /srv/web

Another set of tools are the rlpkg (Gentoo) and fixfiles (CentOS and related distributions) applications. Both these applications have a nice feature: they can be used to reset the contexts of the files of an application rather than having to iterate over the files manually and run restorecon against them.

In the next example...