Restoring Default SELinux Contexts
The objective says "restore default file contexts", and the exam question behind it is always the same: a service cannot read files in a directory it should be able to. The fix is two commands, and the tempting one-command version silently comes undone.
Security and SELinux Guide 57 of 67 Intermediate
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 16 min
semanage fcontext edits policy; restorecon relabels files. Neither does the other's job, and both are needed. chcon changes a file without changing policy, so the next restorecon - or a filesystem relabel - reverses it.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because the exam asks it as a real denial rather than as a command. This matters because chcon works and is still the wrong answer - only a relabel from the policy survives.
- meeting a real denial caused by a wrong label
- adding the rule, and then relabelling from policy
- seeing why
chconworks and is nevertheless the wrong answer
Before you start
- A sudo-capable account and a working repository.
- The session installs
httpd, creates/webroot, and removes both.
-
A real denial
-
The rule, and then the relabel
-
Why not `chcon`