SELinux File Context Drift After Manual Copy

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Application access fails because copied files retain incorrect SELinux contexts.

Environment & Reproduction

Permissions seem correct but service reads/writes fail unexpectedly.

Root Cause Analysis

Manual cp/scp operations can create context drift outside managed paths.

Quick Triage

Inspect labels on source and target directories and check enforce mode.

Step-by-Step Diagnosis

Use ls -Z, semanage fcontext -l, ausearch -m AVC, systemctl status app service, and journalctl.

Solution – Primary Fix

Define persistent fcontext patterns, apply restorecon recursively, restart affected service, and verify no fresh AVC logs.

Solution – Alternative Approaches

App operations succeed and AVC denials stop for corrected paths.

Verification & Acceptance Criteria

Revert newly added fcontext entries if they are overly broad.

Rollback Plan

Use deployment tools that preserve or reapply SELinux labels automatically.

Prevention & Hardening

Run periodic restorecon dry-run checks and alert on drift.

Related Errors & Cross-Refs

Drift accumulates on older systems with repeated manual interventions.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Escalate for complex custom policy scenarios involving multiple domains.