Decode SELinux security context labels into user, role, type and sensitivity components.
Every process and file under SELinux carries a security context in the format user:role:type:level. The SELinux user and role are largely vestiges of the underlying multi-level/role-based access control model and matter less in practice on typical targeted-policy systems; the type field is what SELinux's type enforcement actually uses to decide whether a given domain (process type) may access a given type (file/resource type) — this is the field administrators most often need to change with chcon or restorecon when troubleshooting 'permission denied' errors that persist despite correct standard Unix permissions. The level field encodes the Multi-Level Security or Multi-Category Security sensitivity range, typically s0 on systems not using MLS.
Context format
context = user:role:type:level (4 colon-separated fields; level defaults to s0)
SELinux enforces an additional, independent layer of access control based on type enforcement. Even if standard Unix permissions (owner/group/others) allow access, SELinux will block it if the process's domain type is not permitted by policy to interact with the file's type — a very common cause of confusing web server or service failures.
The SELinux type (ending in _t by convention, like httpd_sys_content_t) is a policy label completely separate from the file's Unix file type (regular file, directory, etc.) — it exists purely so SELinux policy rules can grant or deny access between process domains and object types.
Use restorecon -v <path> to reset a file to its policy-defined default context, or chcon -t <type> <path> to set a specific type manually — the latter change does not persist across a filesystem relabel, so semanage fcontext should be used for permanent changes.