Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have created a few symbolic links to replace some broken links in /etc/pam.d. The original links have system_u as the user. The newly created ones somehow have unconfined_u as the user. I am not sure if there is any security implications to this though the target files all have system_u as the user.

I tried the following:

# restorecon -v thefilename

and

# chcon -v -u system_u thefilename

Both methods do not lead to any change to the user in SELinux security context. Why is that so? Is there any security risk if I don't change the user? And how to make the change?

share|improve this question
    

1 Answer 1

up vote 1 down vote accepted

The SELinux user is ignored in the default targeted policy. It is fine to leave them as is, unless you plan to use the strict or mls policies, or use confined users.

As for changing the context of a symbolic link, you need to use the -h option to chcon so that it changes the context of the symlink, rather than the file to which it points.

share|improve this answer
    
Thanks for the link to explain what is a targeted policy. Does it explain why SELinux-user could not be changed or is there some other reasons? –  Question Overflow Dec 13 '12 at 6:10
1  
You forgot the -h option to chcon. –  Michael Hampton Dec 13 '12 at 6:11
    
Thanks, you are right. That solves it :) –  Question Overflow Dec 13 '12 at 6:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.