SELinux Context Calculator
Parse a SELinux security context string into its user, role, type and sensitivity level components with explanations.
Inputs
Format: user:role:type:level, e.g. system_u:object_r:httpd_sys_content_t:s0
Full Context
system_u:object_r:httpd_sys_content_t:s0
Type (Type Enforcement)
httpd_sys_content_t
SELinux User
system_u
Role
object_r
Sensitivity Level (MLS/MCS)
s0
Field-by-Field Explanation
User 'system_u' (System processes and daemons); Role 'object_r' (Role assigned to all files and objects); Type 'httpd_sys_content_t' is the type-enforcement label that SELinux policy rules actually key off of; Level 's0' is the MLS/MCS sensitivity range.
Step by step
Values used
SELinux Context String = system_u:object_r:httpd_sys_content_t:s0
Context format
context = user:role:type:level (4 colon-separated fields; level defaults to s0)
Full Context
= system_u:object_r:httpd_sys_content_t:s0
Type (Type Enforcement)
= httpd_sys_content_t
SELinux User
= system_u
Role
= object_r
Sensitivity Level (MLS/MCS)
= s0
Field-by-Field Explanation
= User 'system_u' (System processes and daemons); Role 'object_r' (Role assigned to all files and objects); Type 'httpd_sys_content_t' is the type-enforcement label that SELinux policy rules actually key off of; Level 's0' is the MLS/MCS sensitivity range.
How it works
Every process and file under SELinux carries a security context in the format user:role:type:level. The SELinux user and role are largely vestiges of the underlying multi-level/role-based access control model and matter less in practice on typical targeted-policy systems; the type field is what SELinux's type enforcement actually uses to decide whether a given domain (process type) may access a given type (file/resource type) — this is the field administrators most often need to change with chcon or restorecon when troubleshooting 'permission denied' errors that persist despite correct standard Unix permissions. The level field encodes the Multi-Level Security or Multi-Category Security sensitivity range, typically s0 on systems not using MLS.
Formula
Context format
context = user:role:type:level (4 colon-separated fields; level defaults to s0)
- user
- SELinux user identity
- role
- SELinux role
- type
- type enforcement label
- level
- MLS/MCS sensitivity
Frequently Asked Questions
Why do I get 'permission denied' even though ls -l shows correct file permissions?
SELinux enforces an additional, independent layer of access control based on type enforcement. Even if standard Unix permissions (owner/group/others) allow access, SELinux will block it if the process's domain type is not permitted by policy to interact with the file's type — a very common cause of confusing web server or service failures.
What is the difference between the SELinux type and the standard file type?
The SELinux type (ending in _t by convention, like httpd_sys_content_t) is a policy label completely separate from the file's Unix file type (regular file, directory, etc.) — it exists purely so SELinux policy rules can grant or deny access between process domains and object types.
How do I fix a file with the wrong SELinux context?
Use restorecon -v <path> to reset a file to its policy-defined default context, or chcon -t <type> <path> to set a specific type manually — the latter change does not persist across a filesystem relabel, so semanage fcontext should be used for permanent changes.