5.9.4. Archiving Files with tar
The
tar utility does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use the tar --selinux command to create archives that retain contexts and to restore files from the archives. If a tar archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, use the restorecon utility:
~]$tar -xvf archive.tar | restorecon -f -
Note that depending on the directory, you may need to be the root user to run the
restorecon.
The following example demonstrates creating a
tar archive that retains SELinux contexts:
Procedure 5.10. Creating a tar Archive
- Change to the
/var/www/html/directory and view its SELinux context:~]$cd /var/www/html/html]$ls -dZ /var/www/html/drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 . - As root, create three files (
file1,file2, andfile3) in/var/www/html/. These files inherit thehttpd_sys_content_ttype from/var/www/html/:html]#touch file{1,2,3}html]$ls -Z /var/www/html/-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1 -rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2 -rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3 - As root, run the following command to create a
tararchive namedtest.tar. Use the--selinuxto retain the SELinux context:html]#tar --selinux -cf test.tar file{1,2,3} - As root, create a new directory named
/test/, and then allow all users full access to it:~]#mkdir /test~]#chmod 777 /test/ - Copy the
test.tarfile into/test/:~]$cp /var/www/html/test.tar /test/ - Change into
/test/directory. Once in this directory, run the following command to extract thetararchive. Specify the--selinuxoption again otherwise the SELinux context will be changed todefault_t:~]$cd /test/test]$tar --selinux -xvf test.tar - View the SELinux contexts. The
httpd_sys_content_ttype has been retained, rather than being changed todefault_t, which would have happened had the--selinuxnot been used:test]$ls -lZ /test/-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1 -rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2 -rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3 -rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.tar - If the
/test/directory is no longer required, as root, run the following command to remove it, as well as all files in it:~]#rm -ri /test/
See the tar(1) manual page for further information about
tar, such as the --xattrs option that retains all extended attributes.
