restorecon Command in Linux: Restore SELinux File Labels

Updated: 12 October 2026 · Applies to: restorecon from policycoreutils 3.6 (Rocky Linux and AlmaLinux 9, RHEL 9), 3.10 (AlmaLinux and Rocky Linux 10, RHEL 10) and 3.11 (Fedora 44)

The restorecon command resets the SELinux label (security context) of files and folders to the default that the SELinux policy defines for their path. The command you will use most is restorecon -Rv /var/www/html: it relabels the folder and everything inside it and prints each change. Run it as root. Most SELinux "Permission denied" errors after moving or restoring files are fixed this way.

We checked the commands, options and messages below on AlmaLinux 10.2 (policycoreutils 3.10, selinux-policy 42.1) and Rocky Linux 9.8 (policycoreutils 3.6). The matchpathcon and semanage output is real output from that test.

1. See the current label and the correct one

ls -Z /var/www/html/index.html          # the label the file has now
matchpathcon /var/www/html/index.html   # the label the policy wants

Output of matchpathcon for three paths on AlmaLinux 10:

/var/www/html/index.html	system_u:object_r:httpd_sys_content_t:s0
/srv/site/a.html	system_u:object_r:var_t:s0
/root/a.txt	system_u:object_r:admin_home_t:s0

A label has four parts, user:role:type:level. The type (here httpd_sys_content_t) is the part that decides access. matchpathcon -V /var/www/html/* compares both and, according to Red Hat, prints lines such as "has context ..., should be ..." for files that are wrong.

2. Fix one file

restorecon -v /var/www/html/index.html

With -v, restorecon prints one line per changed file in the form Relabeled PATH from OLD-CONTEXT to NEW-CONTEXT. No output means the label was already correct.

3. Fix a whole folder tree

restorecon -Rv /var/www/html

-R (or -r) works through all subfolders. Without it, restorecon only touches the path you name.

4. Preview without changing anything

restorecon -Rnv /var/www/html

-n is a dry run: lines start with Would relabel instead of Relabeled. On version 10 and Fedora, -c also prints how many files were (or would be) relabelled; the restorecon in Rocky Linux and AlmaLinux 9 (policycoreutils 3.6) does not have this option.

5. Force the full default label

restorecon -RFv /var/www/html

By default restorecon changes only the type. -F also resets the user, role and level. It is also needed for "customizable" types: according to the restorecon manual, files with a type listed in /etc/selinux/targeted/contexts/customizable_types (for example httpd_user_content_t and container_file_t on AlmaLinux 10) are not reset without -F.

6. Give your own folder the right label (semanage)

restorecon only applies rules the policy already has. For a folder outside the standard locations, add a rule first (the semanage command is in the policycoreutils-python-utils package), then apply it:

semanage fcontext -a -t httpd_sys_content_t "/srv/site(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/srv/site/uploads(/.*)?"
restorecon -Rv /srv/site

Use httpd_sys_rw_content_t only for folders the web server must write to (uploads, caches). After the two rules, matchpathcon gave:

/srv/site/index.html	system_u:object_r:httpd_sys_content_t:s0
/srv/site/uploads/a.jpg	system_u:object_r:httpd_sys_rw_content_t:s0

To make a folder behave exactly like an existing one, add an equivalence rule instead: semanage fcontext -a -e /var/www /srv/www. List your own rules with semanage fcontext -l -C:

SELinux fcontext                                   type               Context

/srv/site(/.*)?                                    all files          system_u:object_r:httpd_sys_content_t:s0

SELinux Local fcontext Equivalence

/srv/www = /var/www

Remove a rule with semanage fcontext -d "/srv/site/uploads(/.*)?" and run restorecon again. If the command is missing, see semanage command not found.

7. Why mv breaks labels and cp does not

mv keeps the file's old label, so a file moved from /root into /var/www/html keeps admin_home_t and Apache cannot read it. cp creates a new file that gets the label of the target folder. After an mv, or after unpacking a backup, run restorecon on the files. A label set by hand with chcon is also undone the next time restorecon runs on that path, so make lasting changes with semanage fcontext.

8. Skip folders and missing files

• -e /backup: exclude a folder (full path required; repeat for more).
• -x: do not cross into other file systems.
• -i: ignore paths that do not exist, instead of an lstat(...) failed: No such file or directory error. Useful in scripts.
• -f list.txt: relabel the paths listed in a file (-f - reads from standard input).

9. Large trees: progress and threads

restorecon -Rp /srv/data
restorecon -R -T 0 /srv/data

-p shows progress and cannot be combined with -v. -T 0 uses one thread per CPU core (the default is one thread); both versions we checked support it.

10. Relabel the whole system

fixfiles -F onboot
reboot

fixfiles -F onboot creates /.autorelabel, and every file is relabelled during the next boot, which can take a long time on large disks. Do this when you turn SELinux back on after it was disabled, or when many labels are wrong. Red Hat's RHEL 10 guide says to switch to permissive mode first (for example the enforcing=0 kernel option for that boot), check for denials, then return to enforcing. See SELinux modes and how to set them.

Common problems

• restorecon prints nothing and changes nothing: check getenforce. If it says Disabled, restorecon exits silently (we saw this in our test, and the SELinux source code does it on purpose so scripts can call it everywhere). Otherwise the label is already the policy default, the type is customizable (add -F), or your folder needs a semanage fcontext rule first.
• restorecon: command not found: install it with dnf install policycoreutils. matchpathcon is in libselinux-utils.
• Still denied after relabelling: the cause may be an SELinux boolean or a port, not a label. setroubleshoot tells you which; see also SELinux booleans.
• Debian and Ubuntu: they use AppArmor by default, so restorecon is only relevant if you enabled SELinux yourself. Debian 13 ships it in policycoreutils 3.8.1.

More background: SELinux file labelling and contexts. Need help with SELinux on your server? Our Linux server management team can fix labels and policies for you.

Official documentation: restorecon manual page and Using SELinux (Red Hat).