s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

restorecon

Set the SELinux labels of files back to what the policy (and your semanage fcontext rules) say.

Niveau
RHCSA-examen
Groep
SELinux en beveiliging
Root nodig
Ja
Pakket
policycoreutils

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

restorecon -Rv PATH compares each file with the policy's file context rules and fixes wrong labels. Use it after semanage fcontext -a, after moving files with mv, or when a service gets "Permission denied" because of a wrong label. -n only shows what would change.

Zo schrijf je het

restorecon [OPTION]... PATH...
restorecon -f FILE [OPTION]...

Opties 17

Meest gebruikt

-R, -r
Recursive: whole folder trees.
-v
Show every change (twice = more).
-n
Do not change anything; only show (with -v).
-F
Force: also reset user, role and level, not only the type.
-i
Ignore files that do not exist.
-p
Show progress.
-e DIR
Exclude a folder.
-x
Do not cross file system boundaries.
-f FILE
Read the paths from a file (- = stdin).
-0
Paths in -f are separated by NUL.
-m
Do not read /proc/mounts for non-seclabel mounts.
-I
Ignore stored digests (check every file).
-D
Store SHA1 digests to skip unchanged trees next time.
-W
Warn about rules that match no file.
-o FILE
Save the list of wrongly labeled files.
-T N
Use N threads.
-h, -?
Show help.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

  1. 1Fix a folder

    restorecon -Rv /var/www/html
Relabeled /var/www/html/index.html from unconfined_u:object_r:user_home_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

    Typical after mv from a home folder.

  2. 2Apply a new semanage rule

    semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
restorecon -Rv /srv/web

    The rule alone changes nothing on disk.

  3. 3Only check

    restorecon -Rvn /etc

    Lists files with wrong labels without fixing them.

  4. 4Fix one file

    restorecon -v /etc/shadow

    For example after editing it with a tool that changed the label.

  5. 5Fix SSH keys of a user

    restorecon -Rv /home/lisa/.ssh

    Wrong labels on authorized_keys stop key logins.

  6. 6Full system relabel at next boot

    touch /.autorelabel; reboot

    After SELinux was disabled, or many wrong labels.

  7. 7Find wrongly labeled files for a report (security)

    restorecon -Rn -o /root/badlabels.txt /var /srv

    Audit without changing anything.

  8. 8Force full contexts

    restorecon -RF /srv/web

    Also resets the SELinux user part.

  9. 9Many files fast

    restorecon -R -T 0 -p /data

    All CPU threads, with progress.

  10. 10Check the result

    ls -Z /srv/web

    The type column.

Exitcodes

0Done.
255Error.

Volledige handleiding

Deze pagina legt het commando uit in eenvoudige woorden. De originele handleiding heeft elk detail.

In je terminal: man 8 restorecon

Open de man-pagina (linux.die.net)man7.org