chcon

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

chcon -t TYPE FILE writes a new label on the file but does not add a rule to the policy. The next restorecon or full relabel sets the old label again. For permanent labels use semanage fcontext + restorecon.

Zo schrijf je het

chcon [OPTION]... CONTEXT FILE...
chcon [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE...
chcon [OPTION]... --reference=RFILE FILE...

Opties 13

Meest gebruikt

-t, --type=TYPE: Set the type.
-u, --user=USER: Set the SELinux user.
-r, --role=ROLE: Set the role.
-l, --range=RANGE: Set the level/range.
--reference=RFILE: Copy the context of RFILE.
-R, --recursive: Whole trees.
-v, --verbose: Report every file.
-h, --no-dereference: Change links themselves.
--dereference: Change the targets of links (default).
-H, -L, -P: Link handling with -R.
--preserve-root, --no-preserve-root: Protect / with -R.
--help: Show help.
--version: Show the version.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

1Test a type quickly
```
#chcon -t httpd_sys_content_t /srv/test/index.html
```
Works until the next restorecon.
2Copy the label of another file
```
#chcon --reference=/var/www/html /srv/web
```
Same context as /var/www/html.

3A whole folder

#chcon -R -t httpd_sys_content_t /srv/web

Still temporary.

4Watch it disappear
```
#restorecon -v /srv/test/index.html
```
The label goes back to the policy rule.

5The permanent way

#semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"; restorecon -Rv /srv/web

Use this on the exam.

6Break a label for a lab
```
#chcon -t user_home_t /var/www/html/index.html
```
Practice finding AVC denials.
7Show the full context
```
$ls -Z /srv/web
```
Check the result.

8Set the full context at once

#chcon system_u:object_r:httpd_sys_content_t:s0 /srv/web/index.html

All four parts.

9Container volume label (alternative)
```
$podman run -v /srv/data:/data:Z …
```
:Z lets podman set the right label instead of chcon.
10Find files with temporary labels
```
#restorecon -Rvn /srv
```
Shows labels that differ from the policy (chcon changes too).

Exitcodes

`0`	Done.
`1`	Error.

`chcon`

Wat het doet

Zo schrijf je het

Opties 13

Voorbeelden 10

1Test a type quickly

2Copy the label of another file

3A whole folder

4Watch it disappear

5The permanent way

6Break a label for a lab

7Show the full context

8Set the full context at once

9Container volume label (alternative)

10Find files with temporary labels

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 13

Voorbeelden 10

1Test a type quickly

2Copy the label of another file

3A whole folder

4Watch it disappear

5The permanent way

6Break a label for a lab

7Show the full context

8Set the full context at once

9Container volume label (alternative)

10Find files with temporary labels

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Gebruikt in deze labs

Volledige handleiding

`chcon`