matchpathcon(8)

✨ matchpathcon(8) ✨

okay bestie, so this is matchpathcon from the SELinux Command Line documentation, and it's genuinely one of my faves. sit down, grab a lil drink, let's talk default security contexts 💖

---

🌸 NAME 🌸

matchpathcon — get the default SELinux security context for the specified path from the file contexts configuration. that's it, that's the whole vibe 🫶

---

🎀 SYNOPSIS 🎀

matchpathcon [-V] [-N] [-n] [-m type] [-f file_contexts_file] [-p prefix] [-P policy_root_path] filepath...

like, yes, that's a lot of flags, but every single one is doing something, ok?? no filler flags in this house 💅

---

🦋 DESCRIPTION 🦋

So basically matchpathcon goes and queries the system policy, and then it outputs the default security context that's associated with the filepath you gave it. that's the whole job. it's giving "let me look that up for you bestie" energy ✨

⚠️ note, and this one MATTERS: identical paths can totally have different security contexts depending on the file type — regular file, directory, link file, char file, ... you get it. same name, different context. no cap. 😭

And here's the cute part: matchpathcon will also take the file type into consideration when it's figuring out the default security context — but only if the file exists. If the file does not exist, no file type matching will occur. periodt. that's the rule 🌈

---

💅 OPTIONS 💅

• -m type — force the file type for the lookup. the valid types are file, dir, pipe, chr_file, blk_file, lnk_file, sock_file. pick your fighter 🥊
• -n — do not display path. shy mode 🙈
• -N — do not use translations. keep it raw, keep it real 🧚
• -f file_context_file — use an alternate file_context file. (yep, the synopsis spells it file_contexts_file, the option list spells it file_context_file — iconic of it honestly 👑)
• -p prefix — use prefix to speed up translations. zoom zoom 🏎️
• -P policy_root_path — use an alternate policy root path.
• -V — verify that the file context on disk matches the defaults. the "am i actually slaying or am i just claiming to" flag 🔥

---

⭐ EXAMPLE ⭐

Show the default label of sock_file cups.sock:

# matchpathcon -m sock_file /var/run/cups/cups.sock

Verify that the /var/www/html directory is labeled correctly — and just so we're clear, the content of the folder is not checked, only the directory itself 🎀:

# matchpathcon -V /var/www/html

---

💜 AUTHOR 💜

This manual page was written by Dan Walsh <dwalsh@redhat.com>. legend behaviour, honestly 🌸

---

🌈 SEE ALSO 🌈

• selinux(8)
• matchpathcon(3)

---

okay so that's the whole page!! go forth and label things correctly, bestie 💖✨

this one came to you from dwalsh@redhat.com, dated 21 April 2005, in the matchpathcon(8) era of the world 🦋 mwah, bye!! 💅