Home / server / Questions / 1059788
Accepted
Pete
Asked: 2021-04-09 08:54:07 +0800 CST

Linux "ls -Z" shows question mark for security context

  • 772

I've got some files that aren't being served on a site, and assuming it was a permissions issue I ran ls -Z but keep seeing ? in place of the security context:

-rw-rw-r--  pete pete ?                                index.cfm

I get this running sudo as well. Can anyone explain what the ? means or what I need to do to fix the file?

I've tried using sudo chcon system_u:object_r:httpd_config_t:s0 index.cfm to match the other permissions of files in the folder, but that doesn't help. Also if I try to recreate the file I get the ? again

cat index.cfm > index.bkp
sudo ls -Z
-rw-rw-r--  pete pete ?                                index.bkp
-rwxrwxrwx. pete pete system_u:object_r:httpd_config_t:s0 index.cfm
mv index.bkp index.cfm
-rw-rw-r--  pete pete ?                                index.cfm
linux permissions selinux

1 Answers

  1. Best Answer

    The meaning of the exclamation mark is only given in ls info page, not in its man page:

    '-Z'
    '--context'
    '--scontext'
    '--lcontext'
    '--format=context'

    Display the SELinux security context or '?' if none is found. '-Z' counts as format option and enables displaying of SELinux context. '--scontext' prints SELinux context left to the file name. '--lcontext' prints long format with SELinux context in the middle. '--context' prints permissions, user/group, context and file name (in comparison to '--lcontext', omits size, modification time and number of hardlinks).

    Thus, this means that no security context was added to the file. And the fact that it still has no security context when you re-create the file indicates that the parent directory has no security context that can be inherited from.

    • 2