6.7. Changing file sensitivity in MLS

Procedure

1. Check the file’s classification level:

   # ls -lZ /path/to/file
   -rw-r-----. 1 User1 User1 user_u:object_r:user_home_t:s1 0 12. Feb 10:43 /path/to/file

2. Change the file’s default classification level:

   # semanage fcontext -a -r s2 /path/to/file

3. Force the relabeling of the file’s SELinux context:

   # restorecon -F -v /path/to/file
   Relabeled /path/to/file from user_u:object_r:user_home_t:s1 to user_u:object_r:user_home_t:s2

Verification

1. Check the file’s classification level:

   # ls -lZ /path/to/file
   -rw-r-----. 1 User1 User1 user_u:object_r:user_home_t:s2 0 12. Feb 10:53 /path/to/file

2. Optional: Verify that the lower-clearance user cannot read the file:

   $ cat /path/to/file
   cat: file: Permission denied