🏷️ SELinux Contexts

The -Z flag added to ls shows SELinux context:

# Show context for files in current directory
ls -Z

# Show context for a specific file
ls -Z /var/www/html/index.html

# Long listing with context
ls -lZ /var/www/html/

# Show context for a directory
ls -dZ /var/www/html/

# Combine with other options
ls -laZ /etc/httpd/conf/

The -Z flag also works with ps to show process contexts:

# Show context for all processes
ps -eZ

# Show context for a specific process
ps -eZ | grep httpd
ps -eZ | grep sshd

# Full listing with context
ps -eZf | grep nginx

# Show your current shell context
ps -Z $$

unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

restorecon resets file contexts back to what the policy says they should be. This is the correct fix for most context problems:

# Restore context on a single file
sudo restorecon /var/www/html/upload.php

# Restore recursively on a directory
sudo restorecon -R /var/www/html/

# Verbose — show what changed
sudo restorecon -Rv /var/www/html/

# Dry run — show what WOULD change without changing it
sudo restorecon -Rvn /var/www/html/

# Restore after moving files from home directory to web root
sudo cp ~/myapp/* /var/www/html/myapp/
sudo restorecon -Rv /var/www/html/myapp/

chcon changes a file's context directly. Use it for testing and troubleshooting — not as a permanent fix:

# Change the type of a file
sudo chcon -t httpd_sys_content_t /var/www/html/upload.php

# Change type recursively
sudo chcon -R -t httpd_sys_content_t /var/www/html/myapp/

# Copy context from a reference file
sudo chcon --reference=/var/www/html/index.html /var/www/html/upload.php

# Change user field
sudo chcon -u system_u /var/www/html/upload.php

# Change full context at once
sudo chcon -u system_u -r object_r -t httpd_sys_content_t /var/www/html/upload.php

When your files live in a non-standard path, add a persistent context rule with semanage fcontext then apply it with restorecon:

# Add a context rule for a custom web root
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/myapp(/.*)?"

# Apply the rule
sudo restorecon -Rv /srv/myapp/

# Add rule for writable web content (uploads)
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/srv/myapp/uploads(/.*)?"
sudo restorecon -Rv /srv/myapp/uploads/

# List all custom fcontext rules
sudo semanage fcontext -l | grep myapp

# Delete a custom rule
sudo semanage fcontext -d "/srv/myapp(/.*)?"

# List ALL fcontext rules (very long)
sudo semanage fcontext -l | less

Knowing the most common type labels saves enormous troubleshooting time:

# Query what type a path should have
sudo semanage fcontext -l | grep "^/var/www"
sudo semanage fcontext -l | grep "^/etc/httpd"
sudo semanage fcontext -l | grep "^/var/log/httpd"

Processes can only bind to ports that match their type. If you run a service on a non-standard port, you must add it to the SELinux port context:

# List all port contexts
sudo semanage port -l

# Find what type is assigned to port 80 and 443
sudo semanage port -l | grep http

# Add a non-standard port for Apache (e.g., 8080)
sudo semanage port -a -t http_port_t -p tcp 8080

# Add a non-standard SSH port
sudo semanage port -a -t ssh_port_t -p tcp 2222

# Modify an existing port entry
sudo semanage port -m -t http_port_t -p tcp 8443

# Delete a custom port rule
sudo semanage port -d -t http_port_t -p tcp 8080

# List only http-related ports
sudo semanage port -l | grep http_port_t

A complete context workflow for deploying a new application:

#!/bin/bash
# Deploy myapp to /srv/myapp — set correct SELinux contexts

APP_DIR="/srv/myapp"
APP_UPLOAD="$APP_DIR/uploads"
APP_PORT=8080

# 1. Create directories
sudo mkdir -p "$APP_DIR" "$APP_UPLOAD"

# 2. Deploy application files
sudo cp -r /home/deploy/myapp/* "$APP_DIR/"

# 3. Add persistent SELinux context rules
sudo semanage fcontext -a -t httpd_sys_content_t "${APP_DIR}(/.*)?"
sudo semanage fcontext -a -t httpd_sys_rw_content_t "${APP_UPLOAD}(/.*)?"

# 4. Apply the rules
sudo restorecon -Rv "$APP_DIR"

# 5. Add the custom port
sudo semanage port -a -t http_port_t -p tcp $APP_PORT

# 6. Verify contexts look correct
ls -lZ "$APP_DIR"
ls -lZ "$APP_UPLOAD"
sudo semanage port -l | grep $APP_PORT

echo "SELinux context setup complete."