NAME
chcon - change security context

SYNOPSIS
chcon [OPTION]... CONTEXT FILE...
chcon [OPTION]... --reference=RFILE FILE...

DESCRIPTION
Change the security context of each FILE to CONTEXT.

-c, --changes
like verbose but report only when a change is made

-h, --no-dereference
affect symbolic links instead of any referenced file (available
only on systems with lchown system call)

-f, --silent, --quiet
suppress most error messages

-l, --range
set range RANGE in the target security context

--reference=RFILE
use RFILE’s context instead of using a CONTEXT value

-R, --recursive
change files and directories recursively

-r, --role
set role ROLE in the target security context

-t, --type
set type TYPE in the target security context

-u, --user
set user USER in the target security context

-v, --verbose
output a diagnostic for every file processed

--help display this help and exit

--version
output version information and exit

REPORTING BUGS
Report bugs to <email@host.com>.

SEE ALSO
The full documentation for chcon is maintained as a Texinfo manual. If
the info and chcon programs are properly installed at your site, the
command

info chcon
should give you access to the complete manual.

ls -Z file1
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1

查看文件的上下文
~]# ls -Z file1
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
改变文件的上下文
~]# chcon -t samba_share_t file1
~]# ls -Z file1
-rw-rw-r-- user1 group1 unconfined_u:object_r:samba_share_t:s0 file1
恢复文件的上下文
~]# restorecon -v file1
restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:user_home_t:s0

新建文件夹/web，并在其中新建三个文件file{1,2,3}：
~]# mkdir /web
~]# cd /web
~]# touch file{1,2,3}
/web/文件夹和里面的文件都具有default_t类型的标签：
~]# ls -dZ /web
drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web
~]# ls -lZ /web
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3
使用chcon命令把/web/文件夹及其内容的类型改成httpd_sys_content_t：
~]# chcon -R -t httpd_sys_content_t /web/
使用restorecon命令来恢复默认的上下文：
~]# restorecon -R -v /web/
restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /web/file2 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /web/file3 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /web/file1 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0