SELinux Context Calculator
Decode SELinux security context labels into user, role, type and sensitivity components.
About SELinux Context Calculator
Every process and file under SELinux carries a security context in the format user:role:type:level. The SELinux user and role are largely vestiges of the underlying multi-level/role-based access control model and matter less in practice on typical targeted-policy systems; the type field is what SELinux's type enforcement actually uses to decide whether a given domain (process type) may access a given type (file/resource type) — this is the field administrators most often need to change with chcon or restorecon when troubleshooting 'permission denied' errors that persist despite correct standard Unix permissions. The level field encodes the Multi-Level Security or Multi-Category Security sensitivity range, typically s0 on systems not using MLS.
Formula
Context format
context = user:role:type:level (4 colon-separated fields; level defaults to s0)
- user
- SELinux user identity
- role
- SELinux role
- type
- type enforcement label
- level
- MLS/MCS sensitivity
Worked example
With the default values below, SELinux Context Calculator returns Full Context of system_u:object_r:httpd_sys_content_t:s0. Change any input above and every figure here is recalculated in your browser.
Inputs used
- SELinux Context String
- system_u:object_r:httpd_sys_content_t:s0
Results
- Full Context
- system_u:object_r:httpd_sys_content_t:s0
- Type (Type Enforcement)
- httpd_sys_content_t
- SELinux User
- system_u
- Role
- object_r
- Sensitivity Level (MLS/MCS)
- s0
- Field-by-Field Explanation
- User 'system_u' (System processes and daemons); Role 'object_r' (Role assigned to all files and objects); Type 'httpd_sys_content_t' is the type-enforcement label that SELinux policy rules actually key off of; Level 's0' is the MLS/MCS sensitivity range.
Step by step
- 1Values used
- 2Context format
- 3Full Context= system_u:object_r:httpd_sys_content_t:s0
- 4Type (Type Enforcement)= httpd_sys_content_t
- 5SELinux User= system_u
- 6Role= object_r
- 7Sensitivity Level (MLS/MCS)= s0
- 8Field-by-Field Explanation= User 'system_u' (System processes and daemons); Role 'object_r' (Role assigned to all files and objects); Type 'httpd_sys_content_t' is the type-enforcement label that SELinux policy rules actually key off of; Level 's0' is the MLS/MCS sensitivity range.
Assumptions and limits
- The result is derived only from the single input listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why do I get 'permission denied' even though ls -l shows correct file permissions?
SELinux enforces an additional, independent layer of access control based on type enforcement. Even if standard Unix permissions (owner/group/others) allow access, SELinux will block it if the process's domain type is not permitted by policy to interact with the file's type — a very common cause of confusing web server or service failures.
What is the difference between the SELinux type and the standard file type?
The SELinux type (ending in _t by convention, like httpd_sys_content_t) is a policy label completely separate from the file's Unix file type (regular file, directory, etc.) — it exists purely so SELinux policy rules can grant or deny access between process domains and object types.
How do I fix a file with the wrong SELinux context?
Use restorecon -v <path> to reset a file to its policy-defined default context, or chcon -t <type> <path> to set a specific type manually — the latter change does not persist across a filesystem relabel, so semanage fcontext should be used for permanent changes.