chcon tips — authorized SELinux context-change literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run chcon on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any context change — never alter production labels without change control.
3. Record short factual notes; quote short Evidence (path + type/user/role — never secrets).
4. Optional: default-restore peer → restorecon-tips.
5. Optional: process-domain peer → runcon-tips.
6. Prefer disposable lab VMs for chcon drills; quote non-secret labels afterward as Evidence.
7. Prefer documenting ls -Z before/after on lab paths — refuse unauthorized hostile-context cookbooks.
8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

• Classroom labs reviewing chcon -t type changes on authorized disposable hosts.
• Binding short factual notes as Evidence (path + type label — no secrets).
• Documenting expected vs observed manual contexts for authorized notes.
• Comparing chcon ↔ restorecon / runcon / getenforce / selinux peer tip pages under one binder.
• Testing syllabus-approved context changes only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via chcon.
• No intentional unauthorized SELinux context flips against foreign hosts.
• No secret-theft or path/credential harvesting against hosts you do not own.
• No cookbooks that weaken SELinux via hostile context change for attack without authorization.
• No chcon -R framed as an exploit step against production.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with SELinux labeling tools available.
2. Prefer a throwaway lab VM before any recursive chcon drill.
3. With authorization, run ls -Z then chcon -t on a lab file; quote selected labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized context-bypass cookbooks.

Practical notes for authorized labs

• chcon changes SELinux contexts manually — keep Evidence labels distinct from restorecon-tips default restores.
• Pair with runcon-tips when the syllabus zooms on process domain vs file label.
• File lists may embed sensitive paths — never paste secrets into notes or git.
• Prefer documenting path patterns and type labels the syllabus authorized without dumping full privileged trees.
• Never commit SELinux context dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host SELinux context change → refuse.
• Unauthorized MAC-bypass / hostile-context attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources