setfiles(8)

✨ setfiles(8) — SELinux User Command ✨

okay bestie, gather round, because we're about to talk about setfiles, the SELinux girlie whose whole personality is setting file security contexts 💅 this one lives in section 8 of the manual (that's the sysadmin command girlies, iykyk).

---

🌸 NAME 🌸

setfiles — set SELinux file security contexts. that's it. that's the job. she labels files and she does it well 🎀

---

🦋 SYNOPSIS 🦋

setfiles [-c policy] [-C] [-d] [-l] [-m] [-n] [-e directory] [-E] [-p]
[-s] [-v] [-W] [-F] [-U] [-I|-D] [-T nthreads] [-A] spec_file
pathname ...

---

💖 DESCRIPTION 💖

so this manual page describes the setfiles program. she's the main character here, no notes.

her primary slay is initializing the security context fields — that's the extended attributes, for my non-filesystem girlies — on one or more filesystems (or honestly just parts of them, she's flexible like that 💁). usually she gets run the very first time as part of the SELinux installation process, and that step has a whole name: labeling. iconic behavior.

but she's not just a one-time thing, bestie. you can run her any other time too:

• to correct inconsistent labels 🩹
• to add support for newly-installed policy ✨
• or, by using the -n option, to passively check whether the file contexts are all set as specified by the active policy (that's the default behavior, fr fr) or by some other policy — see the -c option for that one 👀

now here's the tea on how she actually writes things. if a file object does not have a context, setfiles will write the default context to the file object's extended attributes. but if a file object does have a context, she'll only modify the type portion of the security context. the -U option will also modify the user and role portions of the security context. and the -F option? that one will force a replacement of the entire context, including the range portion of the security context, and modify customizable files. she said full reset, no crumbs 😤

---

✨ OPTIONS ✨

• -c — check the validity of the contexts against the specified binary policy. vibe check on the policy, basically 👑
• -C — If only relabeling errors are encountered during the file tree walks, exit with status 1 rather than 255. a softer landing, if you will 🫶
• -d — show what specification matched each file. receipts, always receipts 🧾
• -e directory — directory to exclude (repeat option for more than one directory). you can stack these, she doesn't mind 🚫
• -E — treat conflicting specifications as errors, such as where two hardlinks for the same inode have different contexts. drama detected, flag it 📢
• -f infilename — infilename contains a list of files to be processed. Use - for stdin. yes, a real dash, she'll read it 📥
• -F — Force reset of context to match file_context for customizable files, and the default file context, changing the user, role, range portion as well as the type. the full makeover 💅
• -U — In addition to the type portion also change the user and role portions, but not the range portion. a partial glow-up, respect 🎀
• -h, -? — display usage information and exit. she's helpful like that 💖
• -i — ignore files that do not exist. ghosting, but productively 👻
• -I — ignore digest to force checking of labels even if the stored SHA256 digest matches the specfiles SHA256 digest. The digest will then be updated provided there are no errors. See the NOTES section for further details. no shortcuts, we're checking everything 🔍
• -D — Set or update any directory SHA256 digests. Use this option to enable usage of the security.sehash extended attribute. this is the performance hack, remember her name ⭐
• -l — log changes in file labels to syslog. 📝
• -m — do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks. Setting this option is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this. niche but necessary 🧚
• -n — don't change any file labels (passive check). look, don't touch 👀
• -o outfilename — Deprecated - This option is no longer supported. she's moved on, bestie 💀
• -p — show progress by printing the number of files in 1k blocks unless relabeling the entire OS, that will then show the approximate percentage complete. Note that the -p and -v options are mutually exclusive. pick a lane, you cannot have both 🚫
• -q — Deprecated and replaced by -v. Has no effect on other options or on program behavior. she's just vibing there, doing nothing 🙈
• -r rootpath — use an alternate root path. Used in meta-selinux for OpenEmbedded/Yocto builds to label files under rootpath as if they were at /. pretend the root is the root, love that for you 🌈
• -s — take a list of files from standard input instead of using a pathname from the command line (equivalent to -f -). same energy, different door 🚪
• -v — show changes in file labels and output any inode association parameters. Note that the -v and -p options are mutually exclusive. she's chatty but she's not <em>that</em> chatty 💬
• -W — display warnings about entries that had no matching files by outputting the selabel_stats(3) results. the stats girlies rise 📊
• -0 — the separator for the input items is assumed to be the null character (instead of the white space). The quotes and the backslash characters are also treated as normal characters that can form valid input. This option finally also disables the end of file string, which is treated like any other argument. Useful when input items might contain white space, quote marks or backslashes. The -print0 option of GNU find produces input suitable for this mode. null bytes said "i got you" 🫶
• -T nthreads — use up to nthreads threads. Specify 0 to create as many threads as there are available CPU cores; 1 to use only a single thread (default); or any positive number to use the given number of threads (if possible). she can multitask, she just doesn't have to 🔥
• -A — do not track inodes with multiple hard links or bind mounts that would match different contexts (saves memory). less memory, still iconic 🧠

---

🎀 ARGUMENTS 🎀

• spec_file — The specification file which contains lines of the following form:

regexp [type] context | <<none>>

The regular expression is anchored at both ends. The optional type field specifies the file type as shown in the mode field by the ls(1) program, e.g. -- to match only regular files or -d to match only directories. The context can be an ordinary security context or the string <<none>> to specify that the file is not to have its context changed.

The last matching specification is used. If there are multiple hard links to a file that match different specifications and those specifications indicate different security contexts, then a warning is displayed but the file is still labeled based on the last matching specification other than <<none>>. messy? a little. is she still gonna label it? yes ma'am 💅

• pathname ... — The pathname for the root directory of each file system to be relabeled or a specific directory within a filesystem that should be recursively descended and relabeled or the pathname of a file that should be relabeled. Not used if the -f or the -s option is used. 🌸

---

💜 EXIT STATUS 💜

setfiles exits with status 0 if she encounters no errors. slay, flawless run ✨

Fatal errors result in status 255. 😭

Labeling errors encountered during file tree walk(s) result in status 1 if the -C option is specified and no other kind of error is encountered, and in status 255 otherwise. so basically: -C girlies get the gentle 1, everyone else gets the 255 💀

---

🌈 NOTES 🌈

1. setfiles operates recursively on directories. Paths leading up the final component of the file(s) are not canonicalized before labeling. she labels what you gave her, exactly as you gave it, no editing your words 🙅
2. If the pathname specifies the root directory and the -v option is set and the audit system is running, then an audit event is automatically logged stating that a "mass relabel" took place using the message label FS_RELABEL. that's her announcing herself, as she should 📣
3. To improve performance when relabeling file systems recursively the -D option to setfiles will cause it to store a SHA256 digest of the spec_file set in an extended attribute named security.sehash on each directory specified in pathname ... once the relabeling has been completed successfully. These digests will be checked should setfiles -D be rerun with the same spec_file and pathname parameters. See selinux_restorecon(3) for further details.

The -I option will ignore the SHA256 digest from each directory specified in pathname ... and provided the -n option is NOT set, files will be relabeled as required with the digests then being updated provided there are no errors.

---

🔥 EXAMPLE 🔥

Fix labeling of /var/www/ including all sub-directories, using targeted policy file context definitions and list all context changes

# setfiles -v /etc/selinux/targeted/contexts/files/file_contexts /var/www/

List mislabeled files in user home directory and what the label should be based on targeted policy file context definitions

# setfiles -nv /etc/selinux/targeted/contexts/files/file_contexts ~

Fix labeling of files listed in file_list file, ignoring any that do not exist

# setfiles -vif file_list /etc/selinux/targeted/contexts/files/file_contexts

---

👑 AUTHOR 👑

This man page was written by Russell Coker <russell@coker.com.au>. The program was written by Stephen Smalley <stephen.smalley.work@gmail.com>. legends, both of them 🫶

---

🦋 SEE ALSO 🦋

restorecon(8), load_policy(8), checkpolicy(8)

---

okay bestie that's the whole page, and before you go — this little masterpiece was dated 10 June 2016 and it belongs to setfiles(8), the SELinux User Command section. go forth and label responsibly, ily, bye 💖🎀✨