chcon(1)
Change the SELinux security context of files and directories.
Synopsis
chcon [OPTION]... CONTEXT FILE...
chcon [OPTION]... [-u USER] [-r ROLE] [-t TYPE] [-l LEVEL] FILE...Description
chcon changes the SELinux security context attributes of files and directories. The security context consists of user, role, type, and level components that control access permissions under SELinux.
You can specify the context directly as a single argument, or specify individual components (user, role, type, level) separately. Changes are applied recursively with the -R flag.
Note: Context changes do not persist across filesystem relabeling. Use semanage fcontext to make permanent changes.
Common options
| Flag | What it does |
|---|---|
-R, --recursive | change context recursively for directories and their contents |
-v, --verbose | output information about every file processed |
-u USER | set the SELinux user component |
-r ROLE | set the SELinux role component |
-t TYPE | set the SELinux type component |
-l LEVEL | set the SELinux level/category component |
-h, --no-dereference | affect symbolic links themselves, not their targets |
--reference=RFILE | use context from another file instead of specifying it |
-P, --preserve-root | fail rather than operate recursively on the root directory |
Examples
change context to a specific SELinux context on a single file
chcon system_u:object_r:user_home_t:s0 /home/user/file.txtrecursively change context for a web server directory and all contents
chcon -R system_u:object_r:httpd_sys_content_t:s0 /var/www/html/change only the type component of the security context
chcon -t user_home_t /home/user/mydirapply the same context from one location to another file or directory
chcon --reference=/var/www/html /home/user/backupset multiple context components individually
chcon -u user_u -r user_r -t user_home_t /home/user/documentsrecursively change context with verbose output to track changes
chcon -v -R system_u:object_r:var_t:s0 /var/myapp/