I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0

Tried restorecon -vR /etc/pki and semanage fcontext but the file remains in the unconfined_u:object_r:cert_t:s0 context.

  • 1
    Your context should be fine. Why do you want to do this? Mar 17, 2016 at 6:59
  • The libvirt wiki says the file needs to be system_u:object_r:cert_t:s0 wiki.libvirt.org/page/TLSCreateCACert
    – mr.zog
    Mar 17, 2016 at 17:42
  • Show us the output of matchpathcon /etc/pki/CA/certs/cacert.pem and semanage fcontext -l | grep '^/etc/pki(/'. Although I agree with Michael that what you have should be ok.
    – user9517
    Mar 17, 2016 at 20:14
  • The user part is ignored in the SELinux targeted policy, which is what everyone runs by default. You don't need to do anything. Mar 18, 2016 at 2:03
  • [root@kvm ~]# matchpathcon /etc/pki/libvirt/private/kvm_server_privkey.pem system_u:object_r:cert_t:s0 -and- [root@kvm ~]# semanage fcontext -l | grep '^/etc/pki(/' /etc/pki(/.*)? all files system_u:object_r:cert_t:s0
    – mr.zog
    Mar 21, 2016 at 1:01

1 Answer 1


Quick fix

Since your other files are fine, select a specific one for this command:

chcon --reference /etc/pki/CA/certs/validcontextcert.pem /etc/pki/CA/certs/cacert.pem

Longer term fix

You can make a context in SELinux for your file so that it is persistent across context restores.

semanage fcontext -a -u system_u -r object_r -t cert_t '/etc/pki/CA/certs/cacert.pem'

This will make a new context definition that is not yet applied so apply it.

restorecon -RvF /etc/pki
  • matchpathcon /etc/pki/CA/certs/cacert.pem /etc/pki/CA/certs/cacert.pem system_u:object_r:cert_t:s0 The default should be correct.
    – user9517
    Mar 17, 2016 at 20:08
  • @bgstack15 [djb@kvm ~]$ sudo semanage fcontext -a -u system_u -r object_r -t cert_t '/etc/pki/CA/certs/cacert.pem' [sudo] password for msh: usage: semanage [-h] {import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit} ... semanage: error: unrecognized arguments: -u /etc/pki/CA/certs/cacert.pem
    – mr.zog
    Mar 18, 2016 at 18:18
  • This answer seems incorrect (in agreement with mr.zog). semanage fcontext accepts no -u parameter and -r does not change the role, but rather the MLS/MCS security range. Source: man semanage-fcontext.
    – hotkarl
    Nov 1, 2016 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.