Man Linux: Main Page and Category List


       findcon - SELinux file context search tool




       findcon  allows  the user to search for files with a specified context.
       Results can be filtered by object class as described below.


       The findcon tool operates upon a file context list source.   There  are
       three valid file context lists.

              If FCLIST is a name of a directory then begin the search at that
              directory and recurse within it.  Be sure there are no  circular
              mounts within it.

              If   FCLIST   is   the  name  of  a  file_contexts  file  (e.g.,
              /etc/selinux/strict/contexts/files/file_contexts) then open that
              file and find matching entries.

              If FCLIST is the name of a database as created by a previous run
              of indexcon or apol then open the database and  execute  queries
              into it.


       The  following  options allow the user to specify which files to print.
       A file must meet all specified criteria.  If no expression is provided,
       all files are printed.

       -t TYPE, --type=TYPE
              Search for files with a context containing the type TYPE.

       -u USER, --user=USER
              Search for files with a context containing the user USER.

       -r ROLE, --role=ROLE
              Search for files with a context containing the role ROLE.

       -m RANGE, --mls-range=RANGE
              Search  for  files  with  a context with the MLS range of RANGE.
              Note that findcon ignores the SELinux  translation  library,  if
              present.  In addition, this flag is ignored if the FCLIST has no
              MLS information.

              Search for files  matching  this  partial  context.   This  flag
              overrides -t, -u, -r, and -m.

       -p PATH, --path=PATH
              Search for files which include PATH.

       -c CLASS, --class=CLASS
              Search only files of object class CLASS.


       The following additional options are available.

       -R, --regex
              Search   using  regular  expressions  instead  of  exact  string
              matching.  This option does not affect the --class flag.

       -h, --help
              Print help information and exit.

       -V, --version
              Print version information and exit.


       The --context flag specifies a partial context,  which  is  a  a  colon
       separated  list  of  user, role, and type.  If the system supports MLS,
       the context may have a fourth field that gives the range.  If  a  field
       is not specified or is the literal asterisk, then the query will always
       match the field.


       Valid object class strings are

       block, char, dir, fifo, file, link, or sock.


       The findcon utility always operates on "raw" SELinux file contexts.  If
       the  system  has  an  installed translation library (i.e., libsetrans),
       those translations  are  ignored  in  favor  of  reading  the  original
       contexts from the filesystem (if FCFILE is a directory).


       findcon .
              Find  every  context  in  the  current  directory and all of its

       findcon -u user_u .
              Find every context whose user is user_u in the current directory
              and all subdirectories.

       findcon -u system_u -t bin_t file_contexts
              Find entries user system_u and type bin_t within a file_contexts
              file, assuming that file_contexts is a file contexts file.

       findcon --context=system_u::bin_t file_contexts
              This is equivalent to the previous example.

       findcon --context=system_u:*:bin_t:* file_contexts
              This is also equivalent to the above example.


       This manual page was written by Jeremy A. Mowery  <>.


       Copyright(C) 2003-2007 Tresys Technology, LLC


       Please report bugs via an email to


       replcon(1), indexcon(1)