Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I update the package "selinux-policy-targeted" on a Fedora 15 box, as part of yum's post-inst action, a restorecon of the entire disk is called to change the on-disk selinux contexts to match the new rules. However, I have a server with a sizable disk array, with an extraordinary amount of small files, and there is a fairly high IO load most of the time, so this action takes an inordinately long time (read: literally multiple days) to perform this action.

Is there any way to force this restorecon to not take place, or at least let me exclude a directory tree from this action so I can update the OS's contexts for things that matter (i.e. configuration directories, etc) but not for my data...

share|improve this question
up vote 0 down vote accepted

Well, there is option to exclude folder (-e) when you manually invoke the restorecon command, however when it is invoked automatically, it references the restorecond.conf file and reapply the contexts. I suppose you have this large amount of data inside your user home directory, and the ~/* inclusion in the restorecond.conf will be the one that you need to tweak, as there is no option to exclude any folder via this conf, unfortunately.

share|improve this answer
:-/ Greaaaaat. I'm just using backuppc, which uses /var/lib/BackupPC/ as its home directory, and I'm backing up a few TB of machines to there. So, theoretically, any user of this software should be running into this issue as well. Damn. – Clocky Sep 22 '11 at 1:38
You may want to relabel the fs with a different context if the /var/lib/BackupPC is mounted as a separate file system. Check: for more details. – SparX Sep 22 '11 at 1:50
Unfortunately, it's the same filesystem. I can at least fix it via changing my /etc/selinux/restorecond_user.conf, though. (Which contains your referenced ~/* line) – Clocky Sep 22 '11 at 1:51
Nice, so it is fixed now.? – SparX Sep 22 '11 at 18:49

The package doesn't do a complete relabel in %post, as that would be insane for lots of people ... it does:

restorecon -R /root /var/log /var/lock /var/run 2> /dev/null there some reason that is including your backups?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.