2008/2/4, Stephen Smalley <<a href="mailto:sds@tycho.nsa.gov">sds@tycho.nsa.gov</a>>:<div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> On Sat, 2008-02-02 at 17:02 +0900, Shintaro Fujiwara wrote: > Hi, I read man semanage and found that semanage fcontext -a uses > restorecon. > > Does that mean I don't have to restorecon after I semanage fcontext > -a ? semanage fcontext -a adds entries to the local file contexts configuration. It doesn't directly relabel any files. Then, after you've run semanage fcontext -a to add the entry, you can run restorecon or other relabeling programs to actually relabel the files to the context you've specified in the entry.</blockquote><div> OK, I understand. So, I have to relabel by restorecon after I semanage fcontext -a path, right ? </div> I already re-written my program (segatex) to restorecon after semanage fcontext -a -m. Thank you very much. <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> > I just did restorecon fcontext -a and relabeled the system and found > that file context survived. Yes, the relabeling programs (setfiles, restorecon, fixfiles) all consult the file contexts configuration, and semanage fcontext -a is how you add local entries to that configuration. The other way to add entries is by inserting a loadable policy module with its own .fc file. -- Stephen Smalley National Security Agency </blockquote></div> -- <a href="http://intrajp.no-ip.com/">http://intrajp.no-ip.com/</a> Home Page