Checking The Security Context Of A Process, User, Or File Object - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 45. Working With SELinux
The type tmp_t is the default type for temporary files.
Use the -Z option to specify the label for the new file:
cp -Z user_u:object_r:user_home_t foo /tmp
ls -Z /tmp/foo
-rw-rw-r-- auser auser
Moving Files: SELinux Options for mv
Moving files with mv retains the original type associated with the file. Care should be taken using this
command as it can cause problems. For example, if you move files with the type user_home_t into
~/public_html, then the httpd daemon is not able to serve those files until you relabel them. Refer
Section 45.1.3, "Relabeling a File or Directory"
to
Command
mv
cp
cp -p
cp -Z <user:role:type>
Table 45.1. Behavior of mv and cp Commands
45.1.2. Checking the Security Context of a Process, User, or File
Object
Checking a Process ID
In Red Hat Enterprise Linux, the -Z option is equivalent to --context, and can be used with the ps,
id, ls, and cp commands. The behavior of the cp command with respect to SELinux is explained in
Table 45.1, "Behavior of mv and cp
The following example shows a small sample of the output of the ps command. Most of the processes
are running in the unconfined_t domain, with a few exceptions.
[user@localhost ~]$ ps auxZ
LABEL
TIME COMMAND
system_u:system_r:init_t
0:00 init [5]
752
user_u:object_r:user_home_t
for more information about file labeling.
Behavior
The file retains its original label. This may cause problems,
confusion, or minor insecurity. For example, the tmpwatch
program running in the sbin_t domain might not be allowed
to delete an aged file in the /tmp directory because of the file's
type.
Makes a copy of the file using the default behavior based on
the domain of the creating process (cp) and the type of the
target directory.
Makes a copy of the file, preserving the specified attributes and
security contexts, if possible. The default attributes are mode,
ownership, and timestamps. Additional attributes are links and
all.
Makes a copy of the file with the specified labels. The -Z
option is synonymous with --context.
Commands".
USER PID %CPU %MEM
root 1 0.0
/tmp/foo
VSZ RSS TTY
0.1 2032 620 ?
STAT START
Ss 15:09