File Context

Now that you understand SELinux enforcement modes, the next key concept is file context. File contexts are SELinux labels attached to files and directories that determine which processes can access them—think of them as departmental labels on folders in an office. Even if UNIX permissions permit access, SELinux can deny it if the file’s context does not match the service trying to use it.

A diagram titled "File Context" illustrating SELinux access controls. It shows an HR folder accessible by the HR department but denied to Finance, and a web server allowed to access files for the same service but denied for a different service.

Viewing file contexts

Use ls -Z to display SELinux contexts for files and directories:

$ ls -Z /var/www/html
system_u:object_r:httpd_sys_content_t:s0 index.html

A file context has four colon-separated fields:

Field	Meaning	Example
`user`	SELinux user identity for the object	`system_u`
`role`	SELinux role (files commonly use `object_r`)	`object_r`
`type`	Primary attribute used by SELinux policy to allow or deny access	`httpd_sys_content_t`
`level`	MLS/MCS level (most standard systems use `s0`)	`s0`

Components summary:

user:role:type:level

User  - SELinux user identity
Role  - SELinux role used in access control
Type  - Primary field used for policy decisions
Level - For MLS/MCS (usually s0)

When a process requests access to an object, SELinux compares the process context to the object context and consults the loaded policy to allow or deny the action—type is the most important field for those decisions.

Check and change SELinux mode

Quick commands to check SELinux status:

# Show current enforcement mode
root@control:~# getenforce
Enforcing

# Detailed status
root@control:~# sestatus
SELinux status:                enabled
SELinuxfs mount:               /sys/fs/selinux
SELinux root directory:        /etc/selinux
Loaded policy name:            targeted
Current mode:                  enforcing
Mode from config file:         enforcing
Policy MLS status:             enabled
Policy deny_unknown status:    allowed
Memory protection checking:    actual (secure)
Max kernel policy version:     33

Temporarily toggle enforcement at runtime:

# Set permissive mode (SELinux logs denials but does not enforce)
root@control:~# setenforce 0
root@control:~# getenforce
Permissive

# Return to enforcing mode
root@control:~# setenforce 1
root@control:~# getenforce
Enforcing

Persistently change the mode by editing /etc/selinux/config:

# /etc/selinux/config
# SELINUX= can be: enforcing, permissive, disabled
SELINUX=enforcing
SELINUXTYPE=targeted

As an alternative to the config file, you can pass selinux=0 as a kernel argument to disable SELinux at boot. Use grubby to add or remove that kernel argument:

# Persistently disable SELinux at kernel level
root@control:~# grubby --update-kernel=ALL --args="selinux=0"

# Remove the kernel argument to re-enable SELinux at boot
root@control:~# grubby --update-kernel=ALL --remove-args="selinux=0"

Demo: Apache blocked by wrong file context

This demo walks through a common scenario: Apache cannot serve files located in a non-standard directory because those files have the wrong SELinux file context.

Install Apache and create a custom document root:

# Install Apache
root@control:~# dnf install -y httpd

# Create a custom directory for content
root@control:~# mkdir -p /webcontent/html

# Create a simple index.html
root@control:~# echo "Hello world" > /webcontent/html/index.html

Point Apache to the new document root (place these directives in the appropriate httpd configuration file):

# Example configuration changes
DocumentRoot "/webcontent/html"

<Directory "/webcontent">
    AllowOverride None
    Require all granted
</Directory>

<Directory "/webcontent/html">
    # Options and other directives as needed
</Directory>

Start Apache and test:

# Start the service
root@control:~# systemctl start httpd
root@control:~# systemctl status httpd --no-pager
# (status output omitted for brevity)

Request the page — on an enforcing system you may get a 403 Forbidden even though UNIX permissions allow access:

root@control:~# curl -i http://localhost/index.html
HTTP/1.1 403 Forbidden
...
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

Confirm UNIX permissions are correct:

root@control:~# ls -l /webcontent/html/
total 4
-rw-r--r--. 1 root root 12 Apr 27 13:32 index.html

Switch to permissive to confirm SELinux is the cause:

# Confirm SELinux enforcing
root@control:~# getenforce
Enforcing

# Temporarily allow access by setting permissive
root@control:~# setenforce 0
root@control:~# curl -i http://localhost/index.html
HTTP/1.1 200 OK
...
Hello world

This demonstrates that SELinux was blocking access due to file context.

Inspecting contexts: standard vs custom paths

Typical contexts for standard Apache content:

root@control:~# ls -Z /var/www
system_u:object_r:httpd_sys_script_exec_t:s0 cgi-bin
system_u:object_r:httpd_sys_content_t:s0 html

The custom directory still has an unconfined/default label:

root@control:~# ls -Z /webcontent
unconfined_u:object_r:default_t:s0 html

Fixing file contexts with semanage and restorecon

To let Apache serve content from a non-standard directory, add a persistent file-context rule with semanage fcontext and then relabel files with restorecon.

You can consult the semanage fcontext manual for pattern examples; they help construct correct regular-expression paths for matching files and directories.

Example:

# Add a file context rule to label /webcontent and everything under it as web content
root@control:~# semanage fcontext -a -t httpd_sys_content_t "/webcontent(/.*)?"

# Apply the labels to files and directories under /webcontent
root@control:~# restorecon -Rv /webcontent
Relabeled /webcontent from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /webcontent/html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /webcontent/html/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

Verify the new context:

root@control:~# ls -Z /webcontent
unconfined_u:object_r:httpd_sys_content_t:s0 html

Return to enforcing mode and retest:

# Back to enforcing
root@control:~# setenforce 1

# Test the page
root@control:~# curl -i http://localhost/index.html
HTTP/1.1 200 OK
...
Hello world

Because the file type is now httpd_sys_content_t, the httpd policy permits Apache to serve files from /webcontent/html.

Useful commands reference

Command	Purpose
`ls -Z <path>`	Show SELinux contexts for files and directories
`getenforce`	Show current SELinux enforcement mode
`sestatus`	Show detailed SELinux status and policy info
`setenforce 0\|1`	Temporarily set permissive (0) or enforcing (1) mode
`semanage fcontext -a -t <type> "<path_regex>"`	Add a persistent file-context rule
`restorecon -Rv <path>`	Apply/restore SELinux labels to files and directories
`grubby --update-kernel=ALL --args="selinux=0"`	Add kernel arg to disable SELinux at boot
`grubby --update-kernel=ALL --remove-args="selinux=0"`	Remove kernel arg to re-enable SELinux at boot

Summary

SELinux file contexts are labels in the format user:role:type:level.
The type field is used by policy to allow or deny accesses (e.g., httpd_sys_content_t for web content).
Use ls -Z to inspect contexts; semanage fcontext and restorecon add and apply persistent labels.
Toggle enforcement temporarily with setenforce or persistently via /etc/selinux/config or kernel arguments.
When a service is denied access despite correct UNIX permissions, check SELinux contexts and policy.

Links and references

SELinux Project Wiki
Red Hat SELinux Guide
man semanage_fcontext and man restorecon (local man pages)
Apache HTTP Server

Introduction

Working with the Command Line

File Management

Working with Text Files

Output Redirection

User Management

Linux Permissions

Enhanced Command Line

Storage Management

Managing Services

Controlling the Boot Process

Scheduling Future Tasks

Working with Logs

Installing Software

Process Management & Tuning

Managing Network Configuration and Security

SELinux

Configuring SSH

Viewing file contexts

Check and change SELinux mode

Demo: Apache blocked by wrong file context

Inspecting contexts: standard vs custom paths

Fixing file contexts with semanage and restorecon

Useful commands reference

Summary

Links and references

Watch Video

​Viewing file contexts

​Check and change SELinux mode

​Demo: Apache blocked by wrong file context

​Inspecting contexts: standard vs custom paths

​Fixing file contexts with semanage and restorecon

​Useful commands reference

​Summary

​Links and references

Watch Video

Viewing file contexts

Check and change SELinux mode

Demo: Apache blocked by wrong file context

Inspecting contexts: standard vs custom paths

Fixing file contexts with semanage and restorecon

Useful commands reference

Summary

Links and references