Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

  • Comments
  • SELinux novice question about fcontext for a local common/shared directory

    Posted on

    Red Hat Enterprise version 8.8
    1. We are required to have SELinux enabled and enforcing.
    2. We are required to have users assigned to a role other than "unconfined_u" (We semanage login move them from "unconfined_u" into "user_u")
    3. We have a working requirement for a team of analysts to access, read/write/execute files in the same directory ( /data/common).

    Everything works FINE until we set SELinux to "Enforcing."
    In enforcing mode, the analysts cannot read/write or even list files unless we set the semanage fcontext to a file-context-type other than default_t. We have tried multiple reassignments to various defined file types. We can never get to the point of user_u having WRITE access, unless we use "user_home_t" which seems intuitively a bad idea.

    Is there a preexisting SELINUX CONTEXT FILE TYPE that user_u selinux users can access fully, other than "user_home_t"?

    It would seem logical that there would be a corresponding user_t file type, but...

    When I try this:
    semanage fcontext -m -t user_t /data/testfile
    I get this:
    ValueError: Type user_t is invalid, must be a file or device type

    by

    points

    Responses

    Red Hat LinkedIn YouTube Facebook X, formerly Twitter

    Quick Links

    Help

    Site Info

    Related Sites

    © 2026 Red Hat