A file’s SELinux label differs from its path policy · Linux Fix Lab

Symptoms & scope

A service cannot read a file moved from a home directory.
matchpathcon reports a different expected context.

Relevant environment

SELinux-enabled filesystem with matchpathcon and restorecon; changing labels requires the authorized owner or administrator.

Recognizable messages (synthetic examples)

/var/www/html/example.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0

Verify the expected mapping before relabeling; this check alone does not record an application denial.

Possible causes

These are possible explanations, not a confirmed diagnosis. Several independent faults can coexist.

Moving a file within a filesystem may preserve its previous security label.
A legitimate custom content directory may lack a persistent file-context mapping.

Diagnose safely

Run one command at a time in the relevant session. Read the explanation first. Uppercase placeholders need your own values; tools and privileges vary by distribution. These commands are displayed here and never executed by the website.

Check 1

Replace the exact file path; compares its on-disk label with the policy’s default path mapping.

matchpathcon -V /path/to/file

Interpret the result: A has context … should be … result establishes a mismatch, but the default mapping may itself need review for a deliberate custom path.

Check 2

-n is no-change mode. Preview one exact path before considering a recursive operation; read privileges may affect results.

restorecon -n -v /path/to/file

Interpret the result: The proposed context shows what restorecon would apply. No proposed change does not prove that the service is permitted to access the file.

Evidence-guided next steps

Restore the correct default label on confirmed files

If the expected mapping is correct, record existing labels and use restorecon -v on the exact affected files with authorized privileges. Use recursion only after reviewing the directory tree and any deliberate custom mappings.

Precautions: Avoid chcon as a permanent mapping fix; future relabeling can overwrite a temporary label.

Recovery / rollback: Restore intentional prior mappings first, then relabel through that policy. Use recorded labels only when the previous access decision was authorized.

Did this solution help you?

Share this solution #

Define a persistent mapping for an intentional custom directory

If a custom service directory is intended, an administrator can add the documented type or equivalent reference-path mapping with semanage fcontext, then preview and apply restorecon to that limited tree. A mapping change alone does not relabel existing files.

Precautions: Do not label the entire home or /srv tree as service content. Read-only and writable service content may require different types.

Recovery / rollback: Remove only the added local fcontext rule, restore any replaced rule, then run restorecon on the same reviewed paths to apply the previous mapping.