---
name: "restorecon_xattr"
section: "8"
platform: "linux"
package: "policycoreutils"
version: "3.8.1-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/restorecon_xattr"
---

# restorecon\_xattr(8)

manage security.sehash extended attribute entries added by setfiles(8) or restorecon(8).

## NAME

restorecon\_xattr - manage *security.sehash* extended attribute entries added by [**setfiles**(8)](/setfiles/8.md) or [**restorecon**(8)](/restorecon/8.md).

## SYNOPSIS

**restorecon\_xattr** \[**-d**\] \[**-D**\] \[**-m**\] \[**-n**\] \[**-r**\] \[**-v**\] \[**-e** *directory*\] \[**-f** *specfile*\] *pathname*

## DESCRIPTION

**restorecon\_xattr** will display the SHA1 digests added to extended attributes *security.sehash* or delete the attribute completely. These attributes are set by [**restorecon**(8)](/restorecon/8.md) or [**setfiles**(8)](/setfiles/8.md) to specified directories when relabeling recursively.

**restorecon\_xattr** is useful for managing the extended attribute entries particularly when users forget what directories they ran [**restorecon**(8)](/restorecon/8.md) or [**setfiles**(8)](/setfiles/8.md) from.

**RAMFS** and **TMPFS** filesystems do not support the *security.sehash* extended attribute and are automatically excluded from searches.

By default **restorecon\_xattr** will display the SHA1 digests with "Match" appended if they match the default specfile set or the *specfile* set used with the **-f** option. Non-matching SHA1 digests will be displayed with "No Match" appended. This feature can be disabled by the **-n** option.

## OPTIONS

- **-d**

  delete all non-matching *security.sehash* directory digest entries.

- **-D**

  delete all *security.sehash* directory digest entries.

- **-m**

  do not read **/proc/mounts** to obtain a list of non-seclabel mounts to be excluded from relabeling checks.\
   Setting **-m** is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

- **-n**

  Do not append "Match" or "No Match" to displayed digests.

- **-r**

  recursively descend directories.

- **-v**

  display SHA1 digest generated by specfile set (Note that this digest is not used to match the *security.sehash* directory digest entries, and is shown for reference only).

- **-e**

  *directory*\
   directory to exclude (repeat option for more than one directory).

- **-f**

  *specfile*\
   an optional *specfile* containing file context entries as described in [**file\_contexts**(5)](/file_contexts/5.md). If the option is not specified, then the default file\_contexts will be used.

## ARGUMENTS

- *pathname*

  the pathname of the directory tree to be searched.

## EXAMPLE

```
List all paths that where assigned a checksum by "restorecon/setfiles -D"
# restorecon_xattr -r /
Remove all non-matching checksums
# restorecon_xattr -rd /
```

## SEE ALSO

[**restorecon**(8)](/restorecon/8.md), [**setfiles**(8)](/setfiles/8.md)