restorecon\_xattr(8) SELinux User Command restorecon\_xattr(8)

# [NAME](#NAME)

restorecon\_xattr - manage *security.sehash* extended attribute entries added by [**setfiles**(8)](/man/enterprise-packages/policycoreutils/setfiles.8) or [**restorecon**(8)](/man/enterprise-packages/policycoreutils/restorecon.8).

# [SYNOPSIS](#SYNOPSIS)

**restorecon\_xattr** \[**-d**] \[**-D**] \[**-m**] \[**-n**] \[**-r**] \[**-v**] \[**-e** *directory*] \[**-f** *specfile*] *pathname*

# [DESCRIPTION](#DESCRIPTION)

**restorecon\_xattr** will display the SHA1 digests added to extended attributes *security.sehash* or delete the attribute completely. These attributes are set by [**restorecon**(8)](/man/enterprise-packages/policycoreutils/restorecon.8) or [**setfiles**(8)](/man/enterprise-packages/policycoreutils/setfiles.8) to specified directories when relabeling recursively.

**restorecon\_xattr** is useful for managing the extended attribute entries particularly when users forget what directories they ran [**restorecon**(8)](/man/enterprise-packages/policycoreutils/restorecon.8) or [**setfiles**(8)](/man/enterprise-packages/policycoreutils/setfiles.8) from.

**RAMFS** and **TMPFS** filesystems do not support the *security.sehash* extended attribute and are automatically excluded from searches.

By default **restorecon\_xattr** will display the SHA1 digests with "Match" appended if they match the default specfile set or the *specfile* set used with the **-f** option. Non-matching SHA1 digests will be displayed with "No Match" appended. This feature can be disabled by the **-n** option.

# [OPTIONS](#OPTIONS)

[**-d**](#d)

delete all non-matching *security.sehash* directory digest entries.

[**-D**](#D)

delete all *security.sehash* directory digest entries.

[**-m**](#m)

do not read **/proc/mounts** to obtain a list of non-seclabel mounts to be excluded from relabeling checks.  
Setting **-m** is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

[**-n**](#n)

Do not append "Match" or "No Match" to displayed digests.

[**-r**](#r)

recursively descend directories.

[**-v**](#v)

display SHA1 digest generated by specfile set (Note that this digest is not used to match the *security.sehash* directory digest entries, and is shown for reference only).

[**-e**](#e)

*directory*  
directory to exclude (repeat option for more than one directory).

[**-f**](#f)

*specfile*  
an optional *specfile* containing file context entries as described in [**file\_contexts**(5)](/man/enterprise-packages/policycoreutils/file_contexts.5). If the option is not specified, then the default file\_contexts will be used.

# [ARGUMENTS](#ARGUMENTS)

[*pathname*](#pathname)

the pathname of the directory tree to be searched.

# [EXAMPLE](#EXAMPLE)

```
List all paths that where assigned a checksum by "restorecon/setfiles -D"
# restorecon_xattr -r /
Remove all non-matching checksums
# restorecon_xattr -rd /
```

# [SEE ALSO](#SEE_ALSO)

[**restorecon**(8)](/man/enterprise-packages/policycoreutils/restorecon.8), [**setfiles**(8)](/man/enterprise-packages/policycoreutils/setfiles.8)

24 Sept 2016

---

Document: restorecon_xattr(8) from policycoreutils 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git