Change selinux context for TLS cacert.pem

Question

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0

Tried restorecon -vR /etc/pki and semanage fcontext but the file remains in the unconfined_u:object_r:cert_t:s0 context.

The libvirt wiki says the file needs to be system_u:object_r:cert_t:s0 wiki.libvirt.org/page/TLSCreateCACert — mr.zog, Mar 17, 2016 at 17:42
Show us the output of matchpathcon /etc/pki/CA/certs/cacert.pem and semanage fcontext -l | grep '^/etc/pki(/'. Although I agree with Michael that what you have should be ok. — user9517, Mar 17, 2016 at 20:14
The user part is ignored in the SELinux targeted policy, which is what everyone runs by default. You don't need to do anything. — Michael Hampton, Mar 18, 2016 at 2:03
[root@kvm ~]# matchpathcon /etc/pki/libvirt/private/kvm_server_privkey.pem system_u:object_r:cert_t:s0 -and- [root@kvm ~]# semanage fcontext -l | grep '^/etc/pki(/' /etc/pki(/.*)? all files system_u:object_r:cert_t:s0 — mr.zog, Mar 21, 2016 at 1:01

bgStack15 · Accepted Answer · 2016-03-17 19:23:13Z

2

Quick fix

Since your other files are fine, select a specific one for this command:

chcon --reference /etc/pki/CA/certs/validcontextcert.pem /etc/pki/CA/certs/cacert.pem

You can make a context in SELinux for your file so that it is persistent across context restores.

semanage fcontext -a -u system_u -r object_r -t cert_t '/etc/pki/CA/certs/cacert.pem'

This will make a new context definition that is not yet applied so apply it.

restorecon -RvF /etc/pki

answered Mar 17, 2016 at 19:23

bgStack15

1,1311 gold badge13 silver badges23 bronze badges

matchpathcon /etc/pki/CA/certs/cacert.pem /etc/pki/CA/certs/cacert.pem system_u:object_r:cert_t:s0 The default should be correct.
– user9517
Mar 17, 2016 at 20:08
@bgstack15 [djb@kvm ~]$ sudo semanage fcontext -a -u system_u -r object_r -t cert_t '/etc/pki/CA/certs/cacert.pem' [sudo] password for msh: usage: semanage [-h] {import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit} ... semanage: error: unrecognized arguments: -u /etc/pki/CA/certs/cacert.pem
– mr.zog
Mar 18, 2016 at 18:18
This answer seems incorrect (in agreement with mr.zog). semanage fcontext accepts no -u parameter and -r does not change the role, but rather the MLS/MCS security range. Source: man semanage-fcontext.
– hotkarl
Nov 1, 2016 at 19:09

Add a comment |