5.9. Mounting File Systems
By default, when a file system that supports extended attributes is mounted, the security context for each file is obtained from the
extended attribute of the file. Files in file systems that do not support extended attributes are assigned a single, default security context from the policy configuration, based on file system type.
To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the Linux root user, use the
mount -o context=
command when mounting the desired file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the
nfs_t type. Without additional mount options, this may prevent sharing NFS file systems via other services, such as the Apache HTTP Server. The following example mounts an NFS file system so that it can be shared via the Apache HTTP Server:
# mount server:/export /local/mount/point -o\
Newly-created files and directories on this file system appear to have the SELinux context specified with
-o context; however, since context changes are not written to disk for these situations, the context specified with the
context option is only retained if the
context option is used on the next mount, and if the same context is specified.
Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with
-o context, use the SELinux
system_u user and
object_r role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the
When a file system is mounted with a
context option, context changes (by users and processes) are prohibited. For example, running
chcon on a file system mounted with a
context option results in a
Operation not supported error.