chcon

chcon is a command in Linux used to change the SELinux (Security-Enhanced Linux) security context of a file or directory. SELinux uses security contexts, which include user, role, type, and level information, to enforce its security policies. The chcon command allows you to modify the security context of a file or directory without altering the SELinux policy files.

Basic Syntax:

chcon [options] <new-context> <file-or-directory>

Key Components of an SELinux Context:

• User: The SELinux user associated with the file or process, which might differ from the traditional Linux user.
• Role: The SELinux role, which defines what the user can do.
• Type: The most commonly modified component, indicating the type of file or process, used by SELinux to determine access control.
• Level: The sensitivity level, used in multi-level security environments.

Common Options:

• -R: Recursively change the security context of directories and their contents.
• -u: Change the user part of the context.
• -r: Change the role part of the context.
• -t: Change the type part of the context.
• -l: Change the level part of the context.

Example Usage:

1. Change the Type Context:
   Suppose you want to allow Apache (httpd) to serve content from a non-default directory. You would change the type context of the directory to httpd_sys_content_t:

   sudo chcon -R -t httpd_sys_content_t /path/to/your/directory

This command recursively changes the type context of all files and directories within /path/to/your/directory to httpd_sys_content_t, allowing Apache to access them.

2. View the Current Security Context:
   You can use ls -Z to view the current SELinux context of a file or directory:

   ls -Z /path/to/your/file

Example output:

   -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 /path/to/your/file

3. Change Only the User Part of the Context:

   sudo chcon -u system_u /path/to/your/file

This command changes the user part of the context to system_u.

4. Reset a Security Context:
   While chcon changes the context temporarily, it’s often recommended to reset the context using restorecon to align with the policy:

   sudo restorecon -v /path/to/your/directory

This command will reset the SELinux context to its default value based on the SELinux policy.

Practical Scenario:

If you’re hosting a web application and need to serve files from a custom directory /srv/myapp, SELinux by default might block Apache from accessing this directory. To fix this:

1. Change the Context:

   sudo chcon -R -t httpd_sys_content_t /srv/myapp

2. Verify:
   Use ls -Z /srv/myapp to ensure the context has been applied correctly.
3. Start/Restart Apache:

   sudo systemctl restart httpd

Security Considerations:

• Temporary Changes: chcon changes are temporary and might be overridden by relabeling or system policy updates. For permanent changes, consider using policy modules or semanage fcontext.
• Accuracy: Ensure you’re applying the correct context, as incorrect settings can either cause security holes or prevent legitimate access.

Alternatives:

• restorecon: Resets the SELinux context of files and directories to the default defined by SELinux policies.
• semanage fcontext: Used for more permanent and policy-compliant changes to file contexts.

chcon is a useful command for quickly adjusting SELinux contexts to resolve access issues or configure specific permissions, especially in scenarios like configuring web servers or custom applications. However, care should be taken to ensure these changes are accurate and necessary for your security policies.