SELinux Cookbook

Running commands in a specified role with runcon

Using sudo is not mandatory. SELinux also provides a command called runcon that allows users to run a command in a different context. Of course, SELinux restrictions still apply—the user must have the proper privileges to execute commands with a different context.

How to do it…

Running a command using a specified role and type is done by completing the following steps:

1. Identify the domain in which the command should run, usually by checking the executables' context and searching for the entrypoint definition:

   ~$ ls -Z auditctl
   system_u:object_r:auditctl_exec_t    auditctl
   ~$ sesearch -t auditctl_exec_t -c file -p entrypoint -A
   Found 1 semantic av rules:
    allow auditctl_t auditctl_exec_t : file { … entrypoint ...