runcon: Run a command in specified SELinux context
runcon runs file in specified SELinux security context.
runcon context command [args] runcon [ -c ] [-u user] [-r role] [-t type] [-l range] command [args]
Run command with completely-specified context, or with current or transitioned security context modified by one or more of level, role, type and user.
If none of -c, -t, -u, -r, or -l is specified, the first argument is used as the complete context. Any additional arguments after command are interpreted as arguments to the command.
With neither context nor command, print the current security context.
Note also the
setpriv command which can be used to set the
NO_NEW_PRIVS bit using
setpriv --no-new-privs runcon ...,
thus disallowing usage of a security context with more privileges
than the process would normally have.
runcon accepts the following options. Also see Common options.
Compute process transition context before modifying.
Set user user in the target security context.
Set role role in the target security context.
Set type type in the target security context.
Set range range in the target security context.
126 if command is found but cannot be invoked 127 if
runconitself fails or if command cannot be found the exit status of command otherwise