search

SELinuxProject / selinux

This is the upstream repository for the Security Enhanced Linux (SELinux) userland libraries and tools. The software provided by this project complements the SELinux features integrated into the Linux kernel and is used by Linux distributions. All bugs and patches should be submitted to selinux@vger.kernel.org
Other
1.35k stars 360 forks source link

SELinux won't allow changing context #334

Closed djnotes closed 2 years ago

djnotes commented 2 years ago

Description

I am not sure if I have messed up somehow in the past with a directory named src under my home directory, causing it to get the context system_u:object_r:container_file_t (mostly not as a whole). Myabe it happened when I had problems with Podman permissions and trying to give it correct SELinux context. Now, I have created a new wordpress directory in that folder and I want to give it httpd-friendly context following this redhat doc to make it server as the document root of my local Apache instance. So, I run the following commands as root: 

# semanage fcontext -a -t httpd_ sys_content_t "/home/myhome/src(/.*)?"
# restorecon -R -v /home/myhome/src

which gives the following output: 

/home/myhome/src not reset as customized by admin to system_u:object_r:container_file_t:s0:c456,c757
... 
(this is displayed for almost every other file under src)

I have never experienced this before.

System Information

More system information just in case:
Fedora 35 Apache 2.4.51

ghost commented 2 years ago

SELinux has a concept called "customizable_types" and it can be used to tell restorecon not to reset any objects that currently have "customizable types" associated with it -- unless you run restorecon with -F

You can find the list of customizable types here:

. /etc/selinux/config
cat /etc/selinux/"${SELINUXTYPE}"/contexts/customizable_types

So to answer your question, use:

restorecon -R -v -F  /home/myhome/src

instead of:

restorecon -R -v /home/myhome/src

When you see such messages with "customized by admin"