I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0

Tried restorecon -vR /etc/pki and semanage fcontext but the file remains in the unconfined_u:object_r:cert_t:s0 context.

  • 1
    Your context should be fine. Why do you want to do this? – Michael Hampton Mar 17 '16 at 6:59
  • The libvirt wiki says the file needs to be system_u:object_r:cert_t:s0 wiki.libvirt.org/page/TLSCreateCACert – mr.zog Mar 17 '16 at 17:42
  • Show us the output of matchpathcon /etc/pki/CA/certs/cacert.pem and semanage fcontext -l | grep '^/etc/pki(/'. Although I agree with Michael that what you have should be ok. – user9517 Mar 17 '16 at 20:14
  • The user part is ignored in the SELinux targeted policy, which is what everyone runs by default. You don't need to do anything. – Michael Hampton Mar 18 '16 at 2:03
  • [root@kvm ~]# matchpathcon /etc/pki/libvirt/private/kvm_server_privkey.pem system_u:object_r:cert_t:s0 -and- [root@kvm ~]# semanage fcontext -l | grep '^/etc/pki(/' /etc/pki(/.*)? all files system_u:object_r:cert_t:s0 – mr.zog Mar 21 '16 at 1:01

Quick fix

Since your other files are fine, select a specific one for this command:

chcon --reference /etc/pki/CA/certs/validcontextcert.pem /etc/pki/CA/certs/cacert.pem

Longer term fix

You can make a context in SELinux for your file so that it is persistent across context restores.

semanage fcontext -a -u system_u -r object_r -t cert_t '/etc/pki/CA/certs/cacert.pem'

This will make a new context definition that is not yet applied so apply it.

restorecon -RvF /etc/pki
  • matchpathcon /etc/pki/CA/certs/cacert.pem /etc/pki/CA/certs/cacert.pem system_u:object_r:cert_t:s0 The default should be correct. – user9517 Mar 17 '16 at 20:08
  • @bgstack15 [djb@kvm ~]$ sudo semanage fcontext -a -u system_u -r object_r -t cert_t '/etc/pki/CA/certs/cacert.pem' [sudo] password for msh: usage: semanage [-h] {import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit} ... semanage: error: unrecognized arguments: -u /etc/pki/CA/certs/cacert.pem – mr.zog Mar 18 '16 at 18:18
  • This answer seems incorrect (in agreement with mr.zog). semanage fcontext accepts no -u parameter and -r does not change the role, but rather the MLS/MCS security range. Source: man semanage-fcontext. – hotkarl Nov 1 '16 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.