So here you will learn how to set file context labels to make sure that it works in SELinux.
As you already know, every object on your system is labeled with a context label.
And this context label has three different parts.
The user is for user-specific context, the role is for role-specific context, and you
are using neither of them in RHCSA.
It's all about the type.
The type flags which type of operation is allowed on this object.
And in most configurations, only context type matters.
So I repeat, safely ignore user and role for RHCSA.
We have already seen how many commands support the minus uppercase Z option to show current
context information.
Context types are used in the rules of the policy to define which source object has access
to which target object.
And in order to make sure that it works, you need to make sure that a context type is set
that is allowed in the rule in the policy.
And that's exactly what we need to do to fix the situation that we have just reached in
the previous demo.
Now you should understand default context type because RHEL 10 is configured in such
a way that most services don't need additional SELinux configuration if default settings
are used.
So you put your web documents in var www, you should be good.
When files are created in a directory, they typically inherit the context of the parent
directory.
So that should also mean that if you create the files in a directory, you get the appropriate
context.
When files are copied, they typically inherit the context of the parent directory.
So there also, when you copy a file, in fact, you create a new file and your context should
be okay.
But when files are moved, they keep the original context.
Now if ever there is something wrong with your context, to make sure that the context
is repaired, an easy fix is a restore con.
If the location of your file or directories is known to SELinux, restore con is going
to reapply the default context.
But if you create a completely new directory, that is not enough.
And then you need to make sure that you use SEManageFcontext.
SEManageFcontext will allow you to set the file context label.
Now while using SELinuxFcontext, you'll write the context to the SELinux policy, but it's
not written yet to the file system.
In order to add a new context, you use SEManageFcontext-a.
You can also use SEManageFcontext-m to modify an existing context.
But SEManageFcontext-a is probably what you are going to need here.
But after using SEManageFcontext, you will always need to use restore con.
Alternatively, you might also be able to use touch-slash-dot-auto-relabel, but that's in
a specific case.
That is to relabel all files to the context that is specified in the policy.
Touch-slash-dot-auto-relabel is particularly useful if your system temporarily has not
been managed by SELinux.
Then by creating this dot-auto-relabel file and rebooting, you make sure that contexts
are reapplied to the file system in the way that they are defined in the policy.
Now in our case here, with our new directory, we need to do something else.
So we need SEManageFcontext, and it has an amazing man page.
Check it, and you will see how to use it.
I'll do that in the upcoming demo.
Also convenient is SEManageFcontext minus L minus uppercase C, which will show only
settings that have changed in the current policy.
Now let me demonstrate how to fix the situation that we have created before, the situation
of the non-default document route.
We're going to use SEManageFcontext to set the appropriate context.
So what is the situation?
Well, the situation is that LS minus LDZ on slash web is showing that slash web is default
underscore T. And we see that the web document route needs HTTPS content T.
Now let me use man on SEManage-Fcontext.
Use uppercase G to go all the way down, and here you can see the examples.
And you know the cool thing?
The correct example is right here.
So SEManage-Fcontext minus A minus T, followed by the new context type, followed by a regular
expression that expresses the directory slash web and everything that might exist below.
So let me type that, SEManage-Fcontext minus A minus T, HTTPS content T on slash web, and
everything that might be below that directory.
Now sometimes people are saying, wow, why don't you copy-paste it from the man page?
Well, you know, people are often complaining that it's so hard to remember all of it.
By copy-pasting, you won't remember anything.
If you type it for yourself, you'll make lots of typos in the beginning.
But there will be a moment that you can do this without even thinking about it for a
second.
Good.
What did I do now?
I have just written the context to the SELinux policy.
Did that fix my web directory?
It did not.
But if I use restore-con minus RV on the slash web directory, you can see that the context
is relabeled.
So from default underscore T to HTTPS content T, and that goes for slash web and also for
its contents because of the minus R option, which is applying this recursively.
Now I need set-enforce-enforcing, and I'm going to try it again, curl-local-host.
And curl-local-host is still giving me hello web, and that means that it is now working.
There is one more thing that I want to show you, and that is what is happening when you
copy and move a file.
So I'm going to do a little bit of a weird demo.
I'm using LS minus Z on etc-hosts.
There we can see etc-hosts, which says net underscore conf.
Now I'm using CP etc-hosts to dot.
And overwrite it.
Yeah, I want to overwrite it.
And now I'm using LS minus Z on hosts in my current directory.
Well, that's the root home directory, and you can see it has been labeled accordingly
with admin home T. Now I'm removing etc-hosts.
Yes, I want to remove it.
And then I'm going to move the hosts file from my root home directory back to etc.
And now what do we see when we do LS minus Z on etc-hosts?
Well, we see that it has maintained the context, because while moving it, you keep the current
properties.
And how are you going to fix that?
Well, easy, restore-con minus V if you want to see it on etc-hosts.
That should do it for you.
And if ever you get very confused and many files have been misconfigured because you've
been in disabled mode and everything is messed up, don't forget you can always use touch
slash dot auto-relabel, like the way we use while resetting the root user password.
There it was necessary, because in the bin-bash troubleshooting mode, you don't have SELinux yet.