RHEL 10 – SELinux file contexts reset incorrectly on mounted volume – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Applications lose access after reboot because mounted data paths relabel to unexpected SELinux types.

Environment & Reproduction

Often triggered by newly mounted filesystems without persistent fcontext rules.

mount | grep /data
ls -Zd /data

Root Cause Analysis

Context defaults on mount path conflict with service-specific expected labels.

Quick Triage

Inspect mount options, labels, and recent AVC denials.

getenforce
findmnt /data
ausearch -m avc -ts recent | tail -n 20
journalctl -n 50 --no-pager
firewall-cmd --state

Step-by-Step Diagnosis

Verify policy mapping and active contexts before applying relabeling.

semanage fcontext -l | grep '/data'
ls -lZ /data | head -n 60
cat /etc/fstab

Solution – Primary Fix

Define persistent fcontext for mount tree and restore labels.

sudo semanage fcontext -a -t httpd_sys_rw_content_t '/data/app(/.*)?'
sudo restorecon -Rv /data/app
sudo systemctl restart httpd

Solution – Alternative Approaches

Use mount context= option for filesystems that require uniform labels.

# in /etc/fstab add context=system_u:object_r:httpd_sys_rw_content_t:s0
sudo mount -o remount /data

Verification & Acceptance Criteria

Labels remain correct after remount and reboot with no new AVC denials.

ls -Zd /data/app
ausearch -m avc -ts recent | tail -n 20

Rollback Plan

Remove custom fcontext entry and restore prior label policy.

sudo semanage fcontext -d '/data/app(/.*)?'
sudo restorecon -Rv /data/app

Prevention & Hardening

Document SELinux label requirements in storage provisioning automation.

semanage fcontext -l | grep '/data'

Related Errors & Cross-Refs

Related to NFS context inheritance and container bind-mount label flags.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux file context persistence and storage mount option references.