Using Fixfiles and Setting Mount Contexts for SELinux

Using Fixfiles and Setting Mount Contexts for SELinux

Sequence 1. Using fixfiles

The fixfiles can be used to reset the contexts of the files of a particular application rather than having to iterate over the files manually and run restorecon against them. The fixfiles command has three modes, one of which must be specified when running the command:

  • check Show any file-related objects whose security context does not match what is specified in the file context files.
  • restore Relabel any file-related objects whose security context does not match what is specified in the file context files.
  • relabel Like restore, but also optionally removes any files in the /tmp directory first.

    Options:
    -B                                     If specified with onboot, it will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, restore will only affect files that were modified today.
    -l logfile                             Save the output to the specified logfile
    -F                                      Force reset of context to match file_context for customizable files
    -f                                       Clear /tmp directory with out prompt for removal.
    -R rpmpackagename[,rpmpackagename…]
                                             Use the rpm database to discover all files within the specified packages and restore the file contexts. (-a will get all files in the RPM database).
    -C PREVIOUS_FILECONTEXT   Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files.
    -N time                              Only act on files created after the specified date. Date must be specified in “YYYY-MM-DD HH:MM” format.

  1. Check the contexts
    # fixfiles check
  1. Restore context for all openssh files. Will skip virtual filesystem (/sys)
# fixfiles -R openssh restore
  1. Relabel the entire file system without system reboot – Force:
# fixfiles -f -F relabel

The fixfiles command is actually a shell script that uses either restorecon or setfiles depending on the requested use. Instead of requiring the user to specify which files or directories to relabel or check, fixfiles works on all mounted filesystems that support extended attribute labeling.

  1. Relabel the entire file system without system reboot:
# fixfiles relabel
[root@localhost ~]# fixfiles relabel
    Files in the /tmp directory may be labeled incorrectly, this command
    can remove all files in /tmp.  If you choose to remove files from /tmp,
    a reboot will be required after completion.
    Do you wish to clean out the /tmp directory [N]
  1. Setup the machine to relabel on the next reboot.
# fixfiles onboot  

Sequence 2. Context Mounts

To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, use mount -o context=SELinux_user:role:type:level. Context changes are not written to disk.
In case of NFS, this default context uses the nfs_t type. Without additional mount options, this may prevent sharing NFS volumes using other services, such as the Apache HTTP Server.

  1. Mounts an NFS volume so that it can be shared using the Apache HTTP Server:
# mount server:/export /local/mount/point -o \ 
context="system_u:object_r:httpd_sys_content_t:s0"

The context specified with this option does not persist between mounts.

  1. In common policies, this default context uses the file_t type. If it is desirable to use a different default context, mount the file system with the defcontext option.
# mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:s0"
  1. To make context mounts persistent across remounting and reboots, add entries for the file systems in the /etc/fstab file or an automounter map, and use the required context as a mount option:
server:/export /local/mount/ nfs 
context="system_u:object_r:httpd_sys_content_t:s0" 0 0

Complete this lab successfully and avail 80% discount on any course on this website. Drop a mail with screenshot at admin@theskillpedia.com and we will share the discount coupon with you.

Take a look at the Courses offered with Course Contents at https://www.theskillpedia.com/category/course-contents/

 
September 19, 2019

0 responses on "Using Fixfiles and Setting Mount Contexts for SELinux"

Leave a Message

Featured Testimonial

I recommend The Skill Pedia to all those who are looking for a career in Information Technology as Linux Administrator. Trust me, you won't need a certificate after the training, though that would be an added advantage.Read more

Michael John

Certified Engineer

Popular Courses

About The SkillPedia

The Skill Pedia is a platform for online training. It offers great learning experience for learners by offering features such as Interactive Videos, Interaction with Trainer, Assignments, Rich Audio Visuals and Handouts.

The Course Completion Certificate generated automatically based on your performance after the course is complete is an edge.

For Trainers, it is a platform for sharing your Skills which may be in the form of videos, slides, handouts, e-books or even consulting and get up to 85% of the fee you decide for the course.

The Skill Pedia - Learn or Teach a Skill

TheSkillPedia Tweets

top
WhatsApp chat

FESTIVAL OFFER!

 Avail 25% Discount on all Courses!  Offer Expiring on 31st Oct.

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

The Skill Pedia will use the information you provide on this form to be in touch with you and to provide updates and marketing.
X