fixfiles(8)

💖 fixfiles(8) — like, the SELinux context glow-up manual 💖

okay bestie, sit down, hydrate, and let me tell you about fixfiles — it's a fixfiles(8) manual page and it is literally the script that fixes file SELinux security contexts. no cap. 🦋

---

✨ NAME ✨

fixfiles — fix file SELinux security contexts. that's it, that's the whole vibe. 💅

---

✨ SYNOPSIS ✨

okay so there are like, six whole ways to run this thing and you gotta pick the one that matches your situation. here they all are, exactly as written, no edits:

fixfiles [-v] [-F] [-M] [-f] [-T nthreads] relabel

fixfiles [-v] [-F] [-T nthreads] { check | restore | verify } dir/file
...

fixfiles [-v] [-F] [-B | -N time ] [-T nthreads] { check | restore |
verify }

fixfiles [-v] [-F] [-T nthreads] -R rpmpackagename[,rpmpackagename...] {
check | restore | verify }

fixfiles [-v] [-F] [-T nthreads] -C PREVIOUS_FILECONTEXT { check |
restore | verify }

fixfiles [-F] [-M] [-B] [-T nthreads] onboot

---

✨ DESCRIPTION ✨

so this manual page is describing the fixfiles script, periodt. ✨

its whole main character job? correcting the security context database (that's the extended attributes, iykyk) on your filesystems. 💅

you can also run it any time to relabel when you're adding support for a new policy, or just to check whether the file contexts are all behaving the way you expect. by default it will relabel all mounted ext2, ext3, ext4, gfs2, xfs, jfs and btrfs file systems — as long as they do not have a security context mount option. 🫶

want a different approach? you can use the -R flag to use rpmpackages as an alternative. and heads up: the file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories that get excluded from relabeling. 🎀

and fixfiles onboot will set up the machine to relabel on the next reboot. iconic behaviour honestly. 🔥

---

✨ OPTIONS ✨

every single one, bestie, no skipping. 🍓

• -B — if you specify this with onboot, this fixfiles will record the current date in the /.autorelabel file, so it can be used later to speed up labeling. and if you use it with restore, the restore will only affect files that were modified today. ⭐
• -F — force reset of context to match file_context for customizable files. 💅
• -f — clear the /tmp directory with out prompt for removal. 🙈
• -R rpmpackagename[,rpmpackagename...] — use the rpm database to discover all files within the specified packages and restore the file contexts. 🎀
• -C PREVIOUS_FILECONTEXT — run a diff on the PREVIOUS_FILECONTEXT file against the currently installed one, and restore the context of all affected files. 🦋
• -N time — only act on files created after the specified date. the date must be specified in "YYYY-MM-DD HH:MM" format. the date field will be passed to the find --newermt command. ⏰
• -M — bind mount filesystems before relabeling them; this allows fixing the context of files or directories that have been mounted over. 👑
• -v — modify verbosity from progress to verbose. (it runs restorecon with -v instead of -p.) 💬
• -T nthreads — use parallel relabeling, see setfiles(8). 🔥

---

✨ ARGUMENTS ✨

you pick one of these, bestie:

• check | verify — print any incorrect file context labels, showing old and new context, but do not change them. just a lil look, no touching. 👀
• restore — change any incorrect file context labels. 💅
• relabel — prompt for removal of contents of the /tmp directory and then change any incorrect file context labels to match the install file_contexts file. 🎀
• [[dir/file] ... ] — list of files or directories trees that you wish to check file context on. 🌸

---

✨ EXAMPLE ✨

here are the lil glow-up recipes, copy them exactly bestie:

relabel the whole filesystem, except paths listed in /etc/selinux/fixfiles_exclude_dirs

# fixfiles relabel

schedule the machine to relabel on the next boot and force relabeling of customizable types

# fixfiles -F onboot

check labeling of all files from the samba package (while not changing any labels)

# fixfiles -R samba check

---

✨ AUTHOR ✨

this man page was written by Richard Hally <rhally@mindspring.com>. the script was written by Dan Walsh <dwalsh@redhat.com>. legends, honestly. 🫶

---

✨ SEE ALSO ✨

setfiles(8), restorecon(8) — go read those too, they're giving supporting cast. 🌈

---

and that's the whole page, bestie!! 🎀 this was the fixfiles(8) page, dated 2002031409, and you absolutely ate that read. go forth and relabel responsibly. mwah. 💖✨💅