semanage-fcontext(8)

💖 semanage-fcontext — the girlies' guide to SELinux file contexts 💖

okay bestie, welcome to semanage-fcontext(8) — yes that's the manual section, yes I'm obsessed, sit down, we're doing this 🫶

---

✨ NAME ✨

semanage-fcontext — SELinux Policy Management file context tool 🌸

---

✨ SYNOPSIS ✨

semanage fcontext [-h] [-n] [-N] [-S STORE] [ --add ( -t TYPE -f FTYPE
-r RANGE -s SEUSER | -e TARGET_PATH ) FILE_SPEC | --delete ( -t TYPE -f
FTYPE | -e TARGET_PATH ) FILE_SPEC | --deleteall | --extract | --list
[-C] | --modify ( -t TYPE -f FTYPE -r RANGE -s SEUSER | -e TARGET_PATH )
FILE_SPEC ]

like, look at her. a whole menu of moods. pick one 💅

---

✨ DESCRIPTION ✨

semanage is the tool you use to configure certain elements of SELinux policy without needing to modify or recompile anything from policy sources. iconic behavior, honestly.

semanage fcontext specifically handles the default file system labeling on an SELinux system. basically: it maps file paths — using regular expressions — onto SELinux labels. path goes in, label comes out, slay ✨

🦋 about FILE_SPEC 🦋

FILE_SPEC can be either a fully qualified path, or a Perl compatible regular expression (PCRE) that describes fully qualified path(s).

The only PCRE flag in use is PCRE2_DOTALL, which makes a wildcard . match anything, including a new line. yes, even that. 😭

Strings representing paths are processed as bytes (as opposed to Unicode), which means non-ASCII characters are not matched by a single wildcard. no cap, that's just how it is.

🎀 priority tea (this part matters) 🎀

Note, that file context definitions specified using semanage fcontext (i.e. local file context modifications stored in file_contexts.local) have higher priority than those specified in policy modules.

So: whenever a match for a given file path is found in file_contexts.local, no other file context definitions are considered. periodt.

Entries in file_contexts.local are processed from most recent one to the oldest, with the first match being used — as opposed to the most specific match, which is what's used when matching other file context definitions. 🙈

So all your regular expressions should be as specific as possible, to avoid unintentionally impacting other parts of the filesystem. don't be messy with it bestie, she will notice 💀

---

✨ OPTIONS ✨

• -h, --help — Show this help message and exit. the classic "help me" button 🫶
• -n, --noheading — Do not print heading when listing the specified object type. minimalism, but make it CLI.
• -N, --noreload — Do not reload policy after commit. bold move, bestie.
• -C, --locallist — List local customizations. just the local stuff, nothing else 👑
• -S STORE, --store STORE — Select an alternate SELinux Policy Store to manage. shop around, why not 🛍️
• -a, --add — Add a record of the specified object type.
• -d, --delete — Delete a record of the specified object type.
• -m, --modify — Modify a record of the specified object type.
• -l, --list — List records of the specified object type.
• -E, --extract — Extract customizable commands, for use within a transaction.
• -D, --deleteall — Remove all local customizations. all of them. every last one. 💀
• -e TARGET_PATH, --equal TARGET_PATH — Substitute FILE_SPEC with TARGET_PATH for file label lookup. This is used with fcontext. Requires source and target path arguments to be path prefixes and does not support regular expressions. The context labeling for the target subtree is made equivalent to that defined for the source. Note that substitution based on another substitution does not work. no chain reactions here, sorry 🧚
• -f [{a,f,d,c,b,s,l,p}], --ftype [{a,f,d,c,b,s,l,p}] — File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use 'd' to match only directories or 'f' to match only regular files. The following file type options can be passed: f (regular file), d (directory), c (character device), b (block device), s (socket), l (symbolic link), p (named pipe). If you do not specify a file type, the file type will default to "all files". go big or go all-files 🌈
• -s SEUSER, --seuser SEUSER — SELinux user name.
• -t TYPE, --type TYPE — SELinux Type for the object. the main character of the label tbh 👑
• -r RANGE, --range RANGE — MLS/MCS Security Range (MLS/MCS Systems only). SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

---

✨ EXAMPLE ✨

Remember to run restorecon after you set the file context. literally the most important sentence here bestie, don't skip her 💖

Add file-context httpd_sys_content_t for everything under /web

# semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
# restorecon -R -v /web

---

Substitute /home1 with /home when setting file context

i.e. label everything under /home1 the same way /home is labeled

# semanage fcontext -a -e /home /home1
# restorecon -R -v /home1

---

If you substitute /home2 with /home1 from the example above it will not work. You must use direct substitution.

# semanage fcontext -a -e /home /home2
# restorecon -R -v /home2

---

For home directories under top level directory, for example /disk6/home, execute the following commands.

# semanage fcontext -a -t home_root_t "/disk6"
# semanage fcontext -a -e /home /disk6/home
# restorecon -R -v /disk6

---

Add file-context with MLS range s0:c0.c255 for /secure directory (MLS/MCS systems only)

# semanage fcontext -a -t admin_home_t -r s0:c0.c255 "/secure(/.*)?"
# restorecon -R -F -v /secure

---

✨ SEE ALSO ✨

selinux(8), semanage(8), restorecon(8), selabel_file(5)

go read those too, they're all part of the friend group 🌸

---

✨ AUTHOR ✨

This man page was written by Daniel Walsh <dwalsh@redhat.com> — thank you for your service, king 🫡💜

---

and that's the whole page bestie!! this one's dated 20130617 and lives in the semanage-fcontext(8) manual section — old money, timeless, we stan 💅✨🦋💖🎀