s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

restorecon

Set the SELinux labels of files back to what the policy (and your semanage fcontext rules) say.

Level
RHCSA exam
Group
SELinux and security
Needs root
Yes
Package
policycoreutils

What it does

restorecon -Rv PATH compares each file with the policy's file context rules and fixes wrong labels. Use it after semanage fcontext -a, after moving files with mv, or when a service gets "Permission denied" because of a wrong label. -n only shows what would change.

How to write it

restorecon [OPTION]... PATH...
restorecon -f FILE [OPTION]...

Options 17

Most used

-R, -r
Recursive: whole folder trees.
-v
Show every change (twice = more).
-n
Do not change anything; only show (with -v).
-F
Force: also reset user, role and level, not only the type.
-i
Ignore files that do not exist.
-p
Show progress.
-e DIR
Exclude a folder.
-x
Do not cross file system boundaries.
-f FILE
Read the paths from a file (- = stdin).
-0
Paths in -f are separated by NUL.
-m
Do not read /proc/mounts for non-seclabel mounts.
-I
Ignore stored digests (check every file).
-D
Store SHA1 digests to skip unchanged trees next time.
-W
Warn about rules that match no file.
-o FILE
Save the list of wrongly labeled files.
-T N
Use N threads.
-h, -?
Show help.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Fix a folder

    restorecon -Rv /var/www/html
Relabeled /var/www/html/index.html from unconfined_u:object_r:user_home_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

    Typical after mv from a home folder.

  2. 2Apply a new semanage rule

    semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
restorecon -Rv /srv/web

    The rule alone changes nothing on disk.

  3. 3Only check

    restorecon -Rvn /etc

    Lists files with wrong labels without fixing them.

  4. 4Fix one file

    restorecon -v /etc/shadow

    For example after editing it with a tool that changed the label.

  5. 5Fix SSH keys of a user

    restorecon -Rv /home/lisa/.ssh

    Wrong labels on authorized_keys stop key logins.

  6. 6Full system relabel at next boot

    touch /.autorelabel; reboot

    After SELinux was disabled, or many wrong labels.

  7. 7Find wrongly labeled files for a report (security)

    restorecon -Rn -o /root/badlabels.txt /var /srv

    Audit without changing anything.

  8. 8Force full contexts

    restorecon -RF /srv/web

    Also resets the SELinux user part.

  9. 9Many files fast

    restorecon -R -T 0 -p /data

    All CPU threads, with progress.

  10. 10Check the result

    ls -Z /srv/web

    The type column.

Exit codes

0 :: Done. 255 :: Error.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man 8 restorecon

Open the man page (linux.die.net)man7.org