# semanage-fcontext

## NAME



           semanage-fcontext - SELinux Policy Management file context tool
    


## SYNOPSIS



           **semanage fcontext [-h] [-n] [-N] [-S STORE] [ --add ( -t TYPE -f**
           **FTYPE -r RANGE -s SEUSER | -e TARGET_PATH ) FILE_SPEC | --delete (**
           **-t TYPE -f FTYPE | -e TARGET_PATH ) FILE_SPEC | --deleteall |**
           **--extract | --list [-C] | --modify ( -t TYPE -f FTYPE -r RANGE -s**
           **SEUSER | -e TARGET_PATH ) FILE_SPEC ]**
    


## DESCRIPTION



           semanage is used to configure certain elements of SELinux policy
           without requiring modification to or recompilation from policy
           sources.  **semanage fcontext** is used to manage the default file
           system labeling on an SELinux system.  This command maps file
           paths using regular expressions to SELinux labels.
    
           FILE_SPEC may contain either a fully qualified path, or a Perl
           compatible regular expression (PCRE), describing fully qualified
           path(s). The only PCRE flag in use is PCRE2_DOTALL, which causes a
           wildcard '.' to match anything, including a new line.  Strings
           representing paths are processed as bytes (as opposed to Unicode),
           meaning that non-ASCII characters are not matched by a single
           wildcard.
    
           Note, that file context definitions specified using 'semanage
           fcontext' (i.e. local file context modifications stored in
           file_contexts.local) have higher priority than those specified in
           policy modules.  This means that whenever a match for given file
           path is found in file_contexts.local, no other file context
           definitions are considered.  Entries in file_contexts.local are
           processed from most recent one to the oldest, with first match
           being used (as opposed to the most specific match, which is used
           when matching other file context definitions).  All regular
           expressions should therefore be as specific as possible, to avoid
           unintentionally impacting other parts of the filesystem.
    


## OPTIONS



           _-h, --help_
                  Show this help message and exit
    
           _-n, --noheading_
                  Do not print heading when listing the specified object type
    
           _-N, --noreload_
                  Do not reload policy after commit
    
           _-C, --locallist_
                  List local customizations
    
           _-S STORE, --store STORE_
                  Select an alternate SELinux Policy Store to manage
    
           _-a, --add_
                  Add a record of the specified object type
    
           _-d, --delete_
                  Delete a record of the specified object type
    
           _-m, --modify_
                  Modify a record of the specified object type
    
           _-l, --list_
                  List records of the specified object type
    
           _-E, --extract_
                  Extract customizable commands, for use within a transaction
    
           _-D, --deleteall_
                  Remove all local customizations
    
           _-e TARGET_PATH, --equal TARGET_PATH_
                  Substitute FILE_SPEC with TARGET_PATH for file label
                  lookup. This is used with fcontext. Requires source and
                  target path arguments to be path prefixes and does not
                  support regular expressions. The context labeling for the
                  target subtree is made equivalent to that defined for the
                  source.
    
           _-f [{a,f,d,c,b,s,l,p}], --ftype [{a,f,d,c,b,s,l,p}]_
                  File Type. This is used with fcontext. Requires a file type
                  as shown in the mode field by ls, e.g. use 'd' to match
                  only directories or 'f' to match only regular files. The
                  following file type options can be passed: f (regular
                  file),d (directory),c (character device), b (block
                  device),s (socket),l (symbolic link),p (named pipe).  If
                  you do not specify a file type, the file type will default
                  to "all files".
    
           _-s SEUSER, --seuser SEUSER_
                  SELinux user name
    
           _-t TYPE, --type TYPE_
                  SELinux Type for the object
    
           _-r RANGE, --range RANGE_
                  MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range
                  for SELinux login mapping defaults to the SELinux user
                  record range. SELinux Range for SELinux user defaults to
                  s0.
    


## EXAMPLE



           _Remember to run restorecon after you set the file context_
           Add file-context httpd_sys_content_t for everything under /web
           # semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
           # restorecon -R -v /web
    
           Substitute /home1 with /home when setting file context
           i.e. label everything under /home1 the same way /home is labeled
           # semanage fcontext -a -e /home /home1
           # restorecon -R -v /home1
    
           For home directories under top level directory, for example /disk6/home,
           execute the following commands.
           # semanage fcontext -a -t home_root_t "/disk6"
           # semanage fcontext -a -e /home /disk6/home
           # restorecon -R -v /disk6
    


* * *