Learn to verify SELinux relabel operations with concrete commands and quick checks. 04.02.2026 | reading time: 2 min SELinux relabeling can silently break services; this short guide shows how to check that relabels actually applied using commands you can run now. A broken file context Reproduce a wrong label and repair it with a concrete example; run the commands below as root to follow along: ``` # mkdir -p /srv/www # printf "Hello" > /srv/www/index.html # ls -Z /srv/www/index.html unconfined_u:object_r:default_t:s0 /srv/www/index.html # chcon -t tmp_t /srv/www/index.html # ls -Z /srv/www/index.html unconfined_u:object_r:tmp_t:s0 /srv/www/index.html # restorecon -v /srv/www/index.html restorecon reset /srv/www/index.html context unconfined_u:object_r:tmp_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0 # ls -Z /srv/www/index.html unconfined_u:object_r:httpd_sys_content_t:s0 /srv/www/index.html ``` Probe expected labels Verify what the policy expects and inspect rules before and after relabel; useful commands include `matchpathcon -V /srv/www/index.html` to show the expected context, `semanage fcontext -l` to list custom rules, and `sestatus` to confirm SELinux mode — run those commands to see policy intent and compare with `ls -Z` outputs. Flags and full relabel Use `restorecon -R -v` for recursive fixes and `restorecon -v /path` for single items; when system-wide metadata is wrong create `/.autorelabel` and reboot or run distribution tools such as `fixfiles relabel` for a full relabel; note that containers, overlays or bind mounts may need special handling and a live relabel may not affect files outside the namespace. Related utilities Beyond `restorecon`, check `semanage fcontext` to manage persistent file context rules, use `matchpathcon` to query expected labels, and consult audit logs with `ausearch` or `journalctl` when relabeling triggers denials; combine these tools to trace why a relabel did or did not change a context. Finish line A successful relabel shows the expected SELinux type in `ls -Z` and matches `matchpathcon` output; practice these checks after restores or migrations to avoid silent failures and keep services running; pursue deeper SELinux mastery and consider formal certification such as CompTIA Linux+ or LPIC-1 and intensive exam preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. security filesystem utilities troubleshooting
