Quickly see which SELinux contexts files, processes and users carry and decide what to do next. 16.11.2025 | reading time: 2 min SELinux adds security context labels to files, processes and users; knowing how to read them is the first step when a service is denied access. Quick reality check Run the commands in a terminal to see status and labels: ```$ getenforce Enforcing $ ls -Z /var/www/html/index.html -rw-r--r--. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html $ ps -Z | grep httpd system_u:system_r:httpd_t:s0 2345 ? 00:00:01 httpd $ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 $ semanage fcontext -l | grep httpd_sys_content_t /var/www(/.*)? all files system_u:object_r:httpd_sys_content_t:s0 $ matchpathcon /var/www/html/index.html /var/www/html/index.html system_u:object_r:httpd_sys_content_t:s0``` Read processes and users Processes and login contexts reveal which domain a process runs in and whether a user carries expected privileges; use `ps -Z` to inspect running domains and `id -Z` to view the current login context for quick correlation with file types. When labels disagree A file labeled with the wrong type will be refused even if UNIX permissions allow access; check the fcontext mapping with `semanage fcontext -l` and correct persistent defaults with `restorecon -v` or set temporary labels with `chcon` while keeping policy changes via `semanage` for permanence. Audit and debug tips If access is denied, examine audit logs with `ausearch -m avc` or `audit.log` entries and feed them to `audit2why` or sealert to get human-readable explanations and suggested fixes, and verify SELinux mode with `sestatus` or `getenforce` to avoid chasing problems in permissive or disabled systems. Next steps Start by mapping the failing action to a context mismatch: verify file type, process domain and fcontext rules, then choose restorecon, semanage or a boolean to fix the behavior and re-test the operation. Join Bits & Bytes Academy First class LINUX exam preparation. security filesystem utilities troubleshooting
