50.2.2. Relabeling a File System
You may never need to relabel an entire file system. This usually occurs only when labeling a file system for SELinux for the first time, or when switching between different types of policy, such as changing from the targeted to the strict policy.
Relabeling a File System Using init
The recommended method for relabeling a file system is to reboot the machine. This allows the init process to perform the relabeling, ensuring that applications have the correct labels when they are started and that they are started in the right order. If you relabel a file system without rebooting, some processes may continue running with an incorrect context. Manually ensuring that all the daemons are restarted and running in the correct context can be difficult.
Use the following procedure to relabel a file system using this method.
touch /.autorelabelreboot
At boot time,
init.rc checks for the existence of /.autorelabel. If this file exists, SELinux performs a complete file system relabel (using the /sbin/fixfiles -f -F relabel command), and then deletes /.autorelabel.
Relabeling a File System Using fixfiles
It is possible to relabel a file system using the fixfiles command, or to relabel based on the RPM database:
Use the following command to relabel a file system only using the
fixfiles command:
fixfiles relabel
Use the following command to relabel a file system based on the RPM database:
fixfiles -R <packagename> restore
Using
fixfiles to restore contexts from packages is safer and quicker.
Warning
Running
fixfiles on the entire file system without rebooting may make the system unstable.
If the relabeling operation applies a new policy that is different from the policy that was in place when the system booted, existing processes may be running in incorrect and insecure domains. For example, a process could be in a domain that is not an allowed transition for that process in the new policy, granting unexpected permissions to that process alone.
In addition, one of the options to
fixfiles relabel prompts for approval to empty /tmp/ because it is not possible to reliably relabel /tmp/. Since fixfiles is run as root, temporary files that applications are relying upon are erased. This could make the system unstable or behave unexpectedly.
