Context Utilities

albiurs

Hi,

I don't understand the example commads with the according outputs in the lesson:

https://trainingportal.linuxfoundation.org/learn/course/linux-system-administration-essentials-lfs207/linux-security-modules/linux-security-modules?page=7

$ chcon -t etc_t somefile
$ chcon --reference somefile someotherfile

$ ls -Z

-rw-rw-r--. dog dog unconfined_u:object_r:user_home_t:s0 somefile

$ chcon -t etc_t somefile
$ ls -Z

-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0 somefile

$ ls -Z

-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0 somefile
-rw-rw-r--. dog dog unconfined_u:object_r:user_home_t:s0 somefile1

$ chcon --reference somefile somefile1
$ ls -Z

-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0 somefile
-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0 somefile1

Could you please explain what each of the commands does and verify if the returns are really the result of the preceding command/s?

E.g. in the first example on the top, we have two chcon commands followed by an ls -Z command. I don't understand what happened with the reference and why somefile doesn't have the etc_t type. Also shouldn't it be an ls -lZ for the long listing instead of only ls -Z?

Thanks,
Urs

ericegan

Sorry this section is confusing. We will target for clarity in the next update. To clarify, the structure of this section is:
List the commands (with no explanation which is a poor choice)
Show commands and their outputs (with little associated explanation, also a poor choice)

My apologies for this and we will rectify this on next update. Also keep in mind that this is meant to be very much an introduction to SELinux with high level overview.
For now just understand that SELinux is about which processes have permissions to act on which files and directories.
The easiest way to control access is to set the context of a file or directory (and also sockets, ports, etc.) which dictates which processes are allowed to access it.
The -Z command is how to see information regarding a file as it pertains to SELinux. It should be -lZ for the long output as you note.
The point of the series of commands on this page is to show that you can use the context of one file to set the context of another file with the command:
chcon --reference somefile somefile1
Hope that helps for now!

albiurs

Hi Eric,

Thanks for your reply. I think I got it.

Regards,
Urs